docs(control-plane): define grants and runtime authority boundary

[mdheller]

Summary

Add the Agent Registry side of the Matrix / MCP / A2A / capability-lease control-plane slice.

Added

• docs/control-plane-grants-and-runtime-authority.md
• examples/control-plane-capability-grant.example.json

Why

Recent upstream work makes Agent Registry the canonical home for agent specs, identities, sessions, grants, revocation, and runtime authority.

The control-plane split should therefore treat:

• agent-registry as the grant and runtime-authority registry,
• mcp-a2a-zero-trust as the broker/enforcement and zero-trust boundary,
• HolographMe as the human delegation / consent authority,
• agentplane as the execution admission and run/replay evidence surface,
• and policy-fabric as the policy approval / compiled evidence surface.

Boundary

This PR does not implement broker enforcement.

It defines the Agent Registry ownership lane and adds a minimal read-only control-plane grant fixture. Broker enforcement should consume these records from mcp-a2a-zero-trust rather than redefine grant authority there.

Follow-on order

1. mcp-a2a-zero-trust — consume Agent Registry grants and enforce broker/policy/attestation boundary
2. prophet-platform — runtime/deployment skeleton
3. policy-fabric — governed consumer integration