feat(coord-gateway): expose scoped agent identity for local credential verification

## Parent
- #436

## Goal
Add a read-only authenticated identity endpoint so a local launcher can prove that a scoped token belongs to the expected immutable Directory agent ULID.

## Scope
- Return only the caller's immutable Directory agent ID plus the minimal active role projection needed for verification.
- Reuse PlatformDirectory as the runtime role source of truth; do not add a second role registry.
- Fail closed for retired/invalid agents and never echo tokens or secret material.
- Add contract, authorization, and negative tests.

## Acceptance
- A valid scoped token resolves to exactly one active Directory agent ULID.
- Token/agent mismatch and retired identity are rejected.
- Endpoint is read-only, redacts secrets, and is covered by gateway tests.
- `./init.sh` passes.

## Dependencies
- #436
- #396 / PR #402 must be repaired and merged first.

Start with dependencies #436 and #396, including PR #402, then inspect PlatformDirectory and the existing gateway tests. Verify the endpoint's contract, authorization and negative cases, and run ./init.sh; done means valid tokens resolve to one active agent ULID while mismatches, retired agents and secret material are rejected.

Written by the indexing model from the issue text.