Extend .agent-card.yml with mandate fields and least-privilege access control

## Description

#75 defines an agent's ownership and declared scope, but not (a) which actions require human approval, (b) which actions are explicitly forbidden, or (c) a revocable technical identity per least-privilege principles.

## Source

Krav 2 "Avgrenset mandat" and Krav 3 "Tilgang etter minste privilegium" (Retningslinje for agentisk KI i Digdir v1.0).

## Business Goal

An agent's real risk surface is defined by what it's allowed to touch, not just who owns it. Without machine-readable mandate boundaries, there is no way to audit or enforce least privilege at scale.

## Acceptance Criteria

- `.agent-card.yml` schema adds: allowed tasks/tools, actions requiring human approval, explicitly forbidden actions, and a reference to a revocable technical identity.
- Schema validation rejects entries missing these fields for Class 2–3 agents.
- The reference template and contributing guidelines from #75 are updated to reflect the new fields.

## Dependencies

Extends #75. Coordinates with the classification (Class 1–4) and approval-gate issues in this epic.