Follow-ups from #3510/#3512 reviews: registration-time hierarchy enforcement and require_tls empty-URL lint

Two non-blocking follow-ups from the reviews of #3510 and #3512 (both otherwise merge-ready).

1. Registration-time hierarchy enforcement (`agent-governance-python/agent-os/src/agent_os/supervisor.py`).
`register_supervisor` never validates, and `get_authority_chain` will still list a negative-level supervisor last (the final-authority slot) if a caller ignores `validate_hierarchy()`. #3510 makes `validate_hierarchy` catch this, but validation remains advisory. Consider enforcing at registration (reject invalid levels on `register_supervisor`) or documenting the advisory contract prominently. Also optional: `supervisor.py:95`'s new `s.level < 0` raises `TypeError` for non-int levels (parity with main's gap scan, annotated `level: int`) — a violation entry would be friendlier than a crash.

2. Config-time lint for `require_tls: true` with an empty URL (`agent-governance-python/agent-os/src/agent_os/mcp_auth_enforcement.py:210`).
After #3512, the TLS gate correctly checks the configured `entry.url`, but an entry with `require_tls: true` and no URL from either source skips the gate (deliberate, test-pinned, and constrained by spec conformance S10.12 which requires `add_server` with default `url=""` to be allowed). A config-load warning (or `from_yaml` lint) for `require_tls: true` + empty `url` would surface the misconfiguration without violating the spec path. `min_tls_version` is also currently unread — same lint could flag it until implemented.

Start in agent-governance-python/agent-os/src/agent_os/supervisor.py by reading register_supervisor, validate_hierarchy, and get_authority_chain, then inspect mcp_auth_enforcement.py around line 210 and the config-loading path. Review the existing test-pinned empty-URL behavior and spec conformance S10.12. Done means the selected enforcement or advisory-contract behavior and the require_tls empty-URL lint are implemented without breaking that allowed path.

Written by the indexing model from the issue text.