Agent permission infrastructure

Verify actions before agents act.

Use BehalfID to manage agent identities, scoped permissions, audit logs, and signed webhook events from one developer portal.