Agent register API

POST /api/v1/kya/agents is a policy-gated write. Tool id kya.agent.register. No silent mint.

• No parent: human mint mode on the tenant (allow + trail, break-glass, require approve).
• Parent set: always evaluate. Missing APPROVED means no child.
• GET /api/v1/kya/agents?parent= lists children.
• GET /api/v1/kya/agents/orphans lists ACTIVE children of a REVOKED parent (Pro+).
• GET /api/v1/kya/agents/{id}/passport?signed=1 returns a v2 RS256 claim.