Sample: attenu-guard authorization for Strands agents on AgentCore Runtime

Proposing a sample under `03-integrations/agentic-frameworks/strands-agents/authorization/`, a sibling to the existing `observability/` sample.

What it shows: an orchestrator delegating to a sub-agent (agents-as-tools) whose permissions are computed as a subset of the parent's, so a hand-off can only narrow; an out-of-authority tool call cancelled before the tool body runs, through Strands' `BeforeToolCallEvent` hook, no monkeypatching; and the run's decisions recorded in a hash-chained audit log that verifies offline. The offline run uses a scripted model and needs no AWS account; the AgentCore deploy commands are documented, not executed.

The enforcement comes from attenu-guard (Apache-2.0, `pip install 'attenu-guard[strands]'`), which I maintain. It is not part of the AWS SDKs.

Branch is ready on my fork. Per CONTRIBUTING I am opening this issue first; the PR follows and will reference it.

Start in 03-integrations/agentic-frameworks/strands-agents/authorization/ and compare the sibling observability/ sample, then read CONTRIBUTING for sample requirements. Run the offline scripted-model flow without an AWS account and verify that delegated permissions only narrow, unauthorized tool calls are cancelled before execution, and the audit log verifies offline; document AgentCore deployment commands without running them.

Written by the indexing model from the issue text.