feat(signing): async_resolve_agent — bootstrap to JWKS via brand.json (#344)

[bokelley]

Closes #344 (resolver + CLI core). The verifier-side `verify_from_agent_url` factory and the 8 typed `request_signature_*` exceptions ride the same orchestrator and are scoped to a follow-up PR.

What ships

`adcp.signing.agent_resolver` — async-first orchestrator that walks the 3-hop chain ADCP 3.x defines for keys-from-agent-URL discovery:

```
agent_url → get_adcp_capabilities → identity.brand_json_url
→ brand.json (operator-attested) → jwks_uri → JWK set
```

The capabilities hop is the SSRF gap this PR closes — brand.json and JWKS hops were already IP-pinned via `build_async_ip_pinned_transport`. The capabilities fetcher is intentionally not routed through `ADCPClient` because that client is for trusted-counterparty traffic; here `agent_url` is attacker-shaped.

Public surface

```python
from adcp.signing import async_resolve_agent, AgentResolution, AgentResolverError

result: AgentResolution = await async_resolve_agent(
"https://buyer.example.com/mcp\",
agent_type="sales",
)

result.brand_json_url, .jwks_uri, .jwks (RFC 7517), .agent_entry,

.fetched_at, .trace (per-hop)

```

`resolve_agent(...)` is the sync `asyncio.run(...)` wrapper for CLI / scripts. `BrandJsonJwksResolver.jwks_uri` gains a property mirroring the existing `agent_url` property (5 LOC; consumed by the resolver after `force_refresh`).

CLI

```
adcp --resolve https://buyer.example.com/mcp --agent-type sales
adcp --resolve https://buyer.example.com/mcp --agent-type sales --json | jq .jwks_uri
```

`--resolve` is a flag (not a positional subcommand) — sidesteps the saved-alias collision code-reviewer flagged in pre-PR triage.

Design decisions settled in pre-PR triage (see #344 comment)

Blocker	Decision
SSRF on 3 hops	Capabilities hop now pinned; brand.json + JWKS already were.
`identity_posture` / `consistency`	Zero spec provenance — dropped from `AgentResolution`.
PSL extra	Not needed yet (no eTLD+1 binding until Tier 3 #350). No `tldextract` dep added.
CLI alias collision	`--resolve` flag, not positional.
Async-first surface	`async_resolve_agent` canonical; `resolve_agent` thin sync wrapper.
`get_agent_jwks` redundancy	Dropped — JWK set surfaces via `AgentResolution.jwks`.

Tests

11 unit tests in `tests/test_agent_resolver.py`:

• happy path (3 hops succeed → AgentResolution + 3-entry trace)
• each `AgentResolverErrorCode`: `capabilities_unreachable`, `capabilities_invalid`, `brand_json_url_missing`, `brand_json_resolution_failed`, `jwks_fetch_failed`
• body-cap DoS guard
• sync wrapper dispatch via `asyncio.run`
• forward-compat read of `identity.brand_json_url` (3.0.5's `additionalProperties: true` makes the field readable via `model_extra` until 3.1 types it)

Out of scope (follow-up)

• `verify_from_agent_url(request, agent_url, *, agent_type, ...)` factory composing this resolver with the existing verifier.
• 8 typed `request_signature_*` verifier-side error subclasses.
• `tldextract` / eTLD+1 binding — gated on Tier 3 (feat(signing): BrandAuthorizationResolver — per-brand agent authorization (Tier 3, gated on ADCP #3690) #350).

Local gates

• `ruff check src/` — clean
• `mypy src/adcp/` — 745 source files, no issues
• `pytest tests/` — 3109 passed, 26 skipped, 1 xfailed
• `scripts/regenerate_public_api_snapshot.py` — re-run to add the 6 new exports

Test plan

• All 11 `tests/test_agent_resolver.py` cases pass locally
• CLI smoke: `adcp --resolve https://nonexistent.invalid --agent-type sales --json` returns structured `AgentResolverError` JSON with `code: capabilities_unreachable`
• Public-API snapshot regenerated and matches

🤖 Generated with Claude Code