Add agent authorization contracts

[chubes4]

Summary

• Adds generic WP_Agent_* access grant, token, token store, token authenticator, authorization policy, and capability ceiling substrate contracts.
• Extends AgentExecutionPrincipal with workspace, client, and capability ceiling context so token-authenticated runs can carry complete authorization context.
• Documents the authorization model and adds smoke coverage for token metadata, bearer authentication, access grants, and capability ceiling composition with WordPress capabilities.

Fixes #58.

Testing

• composer test
• homeboy lint --path /Users/chubes/Developer/agents-api@chubes-agent-authorization-ceilings
• homeboy test --path /Users/chubes/Developer/agents-api@chubes-agent-authorization-ceilings

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Source audit, implementation drafting, smoke test coverage, docs updates, and verification loop. Chris remains responsible for review and testing.