Drive the federation event-fetcher service directly, one subcommand per
federation op. Diagnostic only: validation toggles default off so a
malformed or unauthenticatable response is still shown; pass verify to
turn the full poison-detection path on.