feat(identity): export versioned registry snapshot from PlatformDirectory

Parent: #384 (P0-2c). Depends on P0-2a.

## Scope
Downgrade .harness/agents/registry.yaml to a generated, read-only PlatformDirectory snapshot with schema version and source digest.

## Acceptance
- Deterministic export includes version, digest, generated_at, and role fields.
- identity-audit fails on snapshot drift or digest mismatch.
- Agent specs generation consumes the snapshot without treating it as a mutable authority.
- Tests prove deterministic output and tamper detection.

Delivery discipline: one issue, one worker branch, one PR.

Start by locating PlatformDirectory and the generated .harness/agents/registry.yaml snapshot, then trace identity-audit and agent specs generation. Done means deterministic output contains the stated fields, drift and digest tampering fail validation, and tests cover deterministic export and tamper detection.

Written by the indexing model from the issue text.