draft-openbotauth-agent-identity-00

[hammadtq]

This PR adds the first draft of the OpenBotAuth Agent Identity & Passport spec:

• Defines agent: and sub-agent identifiers
• Introduces principals and Agent Delegation Tokens (ADT, JWS-based)
• Describes mapping from agent-id → registry → key directory
• Specifies Signature-Agent usage and required signed components
• Adds optional 402 Agent Required semantics
• Documents Agent Cards and basic security considerations

What I’d like feedback on:

• Whether the principal/ADT model matches how you’re thinking about ownership
• If the sub-agent convention (agent:.../voice, .../browser) + registry fields feel right
• Any sections that are too heavy / need to be split out or simplified

Feel free to edit the draft directly in the PR or leave comments/suggestions inline.