feat(api): add verified agent identity registry and grant binding

## Summary

Add first-class verified agent identities to MCP Runtime and allow grants, sessions, policies, and audit events to bind to those identities.

This is inspired by Vertex AI Agent Engine agent identity, where each deployed agent gets a lifecycle-bound principal and logs can show both the user identity and the agent identity.

## Why

Today MCP Runtime has agent IDs, sessions, grants, and team context, but agent identity is still mostly caller-provided metadata. For enterprise deployments, the platform should verify which agent is calling before authorizing high-risk tools or delegated access.

## Proposed design

- Add an agent identity registry to the platform API.
- Support multiple verification sources: OIDC/JWT, SPIFFE/SPIRE, mTLS client certificate identity, static dev identity for test mode, and future provider identities.
- Extend `MCPAccessGrant` / rendered gateway policy to bind subjects to verified agent principals.
- Preserve human identity plus verified agent identity in session creation and audit events.
- Add admin/API/UI visibility into registered agents, identities, trust source, last seen time, and active sessions.

## Acceptance criteria

- Platform can register and list verified agent identities.
- Gateway rejects requests that claim an agent ID but fail configured verification.
- Grants can target a verified agent principal, not only a raw header/session string.
- Adapter session creation records both human/user identity and verified agent identity when present.
- Audit events include `agent_identity`, `agent_identity_source`, `human_identity`, `team_id`, `session_id`, and verification result.
- Test mode keeps a simple dev path without weakening production defaults.
- Unit and e2e tests cover valid identity, invalid identity, missing identity, cross-team denial, and delegated user plus agent flows.
- Docs explain how to configure OIDC/JWT and SPIFFE/mTLS verification.

## References

- https://cloud.google.com/agent-builder/agent-engine/agent-identity
- https://docs.cloud.google.com/agent-builder/agent-engine/agent-identity
- https://docs.cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/manage/access

Start by mapping the platform API, gateway verification, grant and policy handling, adapter session creation, audit events, admin/API/UI visibility, and the unit and e2e test areas described in the issue. Clarify the identity and trust-source design before implementation; done means registration and verification work across valid, invalid, missing, cross-team, and delegated flows, with production-safe test mode and OIDC/JWT and SPIFFE/mTLS documentation.

Vom Indexierungsmodell aus dem Issue-Text verfasst.