feat(api): add verified agent identity registry and grant binding

## Summary

Add first-class verified agent identities to MCP Runtime and allow grants, sessions, policies, and audit events to bind to those identities.

This is inspired by Vertex AI Agent Engine agent identity, where each deployed agent gets a lifecycle-bound principal and logs can show both the user identity and the agent identity.

## Why

Today MCP Runtime has agent IDs, sessions, grants, and team context, but agent identity is still mostly caller-provided metadata. For enterprise deployments, the platform should verify which agent is calling before authorizing high-risk tools or delegated access.

## Proposed design

- Add an agent identity registry to the platform API.
- Support multiple verification sources: OIDC/JWT, SPIFFE/SPIRE, mTLS client certificate identity, static dev identity for test mode, and future provider identities.
- Extend `MCPAccessGrant` / rendered gateway policy to bind subjects to verified agent principals.
- Preserve human identity plus verified agent identity in session creation and audit events.
- Add admin/API/UI visibility into registered agents, identities, trust source, last seen time, and active sessions.

## Acceptance criteria

- Platform can register and list verified agent identities.
- Gateway rejects requests that claim an agent ID but fail configured verification.
- Grants can target a verified agent principal, not only a raw header/session string.
- Adapter session creation records both human/user identity and verified agent identity when present.
- Audit events include `agent_identity`, `agent_identity_source`, `human_identity`, `team_id`, `session_id`, and verification result.
- Test mode keeps a simple dev path without weakening production defaults.
- Unit and e2e tests cover valid identity, invalid identity, missing identity, cross-team denial, and delegated user plus agent flows.
- Docs explain how to configure OIDC/JWT and SPIFFE/mTLS verification.

## References

- https://cloud.google.com/agent-builder/agent-engine/agent-identity
- https://docs.cloud.google.com/agent-builder/agent-engine/agent-identity
- https://docs.cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/manage/access