fix(adagents): inline-resolution path for publisher_properties selectors + publisher_domains[] fan-out

[bokelley]

Refs #749

Fixes the two bugs in _resolve_agent_properties for the publisher_properties authorization type (Part 1 of #749):

1. Wrong return value — the function was returning raw selector dicts (objects with publisher_domain, selection_type, property_tags, etc.) instead of the resolved property objects those selectors describe. get_properties_by_agent(cafemedia_data, "https://interchange.io") now returns the inline properties rather than 1 selector dict.

2. No publisher_domains[] fan-out — the compact publisher_domains[] array form from adcp#4825/4827 wasn't expanded into per-domain resolution. _selector_domains() now handles both the scalar publisher_domain field and the compact array form.

New helpers:

• _selector_domains(selector) — extracts domain(s) from either scalar or array form
• _resolve_inline(selector, parent_properties, domain) — attempts inline resolution from the parent file's top-level properties[]; returns None when no inline data exists for the domain (federated fallback hook-point), [] when inline data exists but nothing matches the selector filter (real empty; no fallback)

Deferred from #749:

• Federated fetch (HTTP per-domain fallback when inline data absent) — deferred; the None return from _resolve_inline is where it hooks in
• Part 2 (directory inverse-lookup fetch_agent_authorizations_from_directory) — held pending clarification on endpoint path and return type (see comment on feat(adagents): inline-resolution path for publisher_properties selectors + directory inverse-lookup wrapper #749)
• revoked_publisher_domains[] revocation — deferred pending schema definition
• Divergence logging — deferred pending normative citation from adcp#4827

What was tested

• ruff check src/adcp/adagents.py tests/test_adagents.py — clean
• mypy src/adcp/adagents.py — clean (0 errors)
• pytest tests/test_adagents.py — 125 passed, 0 failed
• Existing test_get_properties_by_agent_publisher_properties rewritten to assert resolved property objects (previously encoded the buggy selector-passthrough behavior)
• New: test_get_properties_by_agent_publisher_domains_fanout — publisher_domains[] compact form fans out correctly
• New: test_get_properties_by_agent_publisher_properties_no_inline — empty properties[] returns []
• New: test_get_properties_by_agent_publisher_properties_by_id — selection_type: "by_id" filters correctly

Pre-PR review

• code-reviewer: approved — fixed by_id str filter, multi-selector deduplication, and missing by_id unit test per blocker findings; one nit surfaced (empty by_tag passthrough is permissive; acceptable given schema minItems: 1 upstream)
• ad-tech-protocol-expert: approved for Part 1 inline path; publisher_domains[] schema gap noted (schema cache needs updating from adcp#4827 — tracked separately); None docstring reworded to avoid forward-declared MUST obligation

Nits (not fixed):

• by_tag with empty property_tags returns all domain candidates (permissive); schema enforces minItems: 1 upstream so this path is unreachable on valid input
• _selector_domains silently ignores non-list publisher_domains values (intentional defensive drop)

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See adcp#3121
for context.

Session: https://claude.ai/code/${CLAUDE_CODE_REMOTE_SESSION_ID}

---

Generated by Claude Code