Accept actorless FeatureRequest activities

Authenticate actorless FEP-7aa9 requests against the owner of the
referenced collection, then use that owner as the actor passed to the
listener. Preserve the signed document and carry the authenticated
owner through queued processing and retries.

Keep transient collection lookup failures retryable, and reject the
activity on permanent failures. Add regression coverage for HTTP
Signatures, Linked Data Signatures and Object Integrity Proofs, mixed
signatures, forged ownership, queue retries and lookup errors.

Fixes #1289
General inbox principal handling is deferred to:
#1290

Codex assisted the implementation and tests and reviewed the plan with
gpt-6-astra. Claude Code assisted the fixes from code review.

Assisted-by: Codex:gpt-6.1-sol
Assisted-by: Claude Code:claude-opus-5-5

Author: dahlia

CHANGES.md

@@ -8,6 +8,16 @@ Version 2.4.3
 
 To be released.
 
+### @fedify/fedify
+
+ -  Fixed the inbox rejecting FEP-7aa9 `FeatureRequest` activities without
+    an `actor`, allowing applications to receive collection inclusion
+    requests from Mastodon.  Requests are accepted only when authenticated
+    as the referenced collection's owner.  [[#1289], [#1291]]
+
+[#1289]: https://github.com/fedify-dev/fedify/issues/1289
+[#1291]: https://github.com/fedify-dev/fedify/pull/1291
+
 
 Version 2.4.2
 -------------

changes.d/fedify/actorless-feature-requests.md

@@ -0,0 +1,9 @@
+---
+links:
+  '#1289': https://github.com/fedify-dev/fedify/issues/1289
+  '#1291': https://github.com/fedify-dev/fedify/pull/1291
+---
+ -  Fixed the inbox rejecting FEP-7aa9 `FeatureRequest` activities without
+    an `actor`, allowing applications to receive collection inclusion
+    requests from Mastodon.  Requests are accepted only when authenticated
+    as the referenced collection's owner.  [[#1289], [#1291]]