Harden Agent Registry grant request scope

[mdheller]

Summary

• Hardens AgentRegistryGrant so grant requests carry explicit requested provider/model/tool/cache/memory/storage/evidence scope and requested expiration.
• Adds grant response revocation status, revocation hook, and optional non-authoritative external trust signals.
• Updates active, render-only, missing, and revoked grant examples to match the stricter request/response shape.
• Strengthens governance semantic validation so allowed grant scope must be requested, active grants require revocation hooks, and external trust signals remain non-authoritative verifier inputs.
• Adds docs/architecture/agent-registry-grants.md to document the SourceOS trust boundary and the PCH/ERC-8004-style adapter stance.

Validation

• Locally checked the revised JSON Schema with jsonschema draft 2020-12 validation in the assistant sandbox.
• Locally checked the updated active, render-only, missing, and revoked example payloads against the revised schema in the assistant sandbox.
• Locally syntax-checked the revised governance.py content in the assistant sandbox.

Full repository make validate still needs GitHub Actions or a live checkout run before production promotion.

Closes #5