Add agent authorization interoperability crosswalk

[dinpd]

What changed

• adds a field-level crosswalk across OAuth/OIDC, AuthZEN, WIMSE, MCP, Shared Signals, request integrity, and adjacent agent-authorization drafts
• adds a deterministic MCP authorization interoperability fixture and one-command runner
• tests valid provider verification and linked execution closure, plus mutated-action, wrong-audience, and replay rejection
• links the research and fixture from the project documentation

Why

Issue #69 identified a standards-emergence opportunity, but the repository lacked a concrete field-level comparison and executable evidence that the existing AgentPass model can compose with those standards at a provider trust boundary.

Impact

This is experimental, non-normative interoperability guidance. It adds no production protocol, live integration, dependency, or DID requirement. The fixture uses synthetic .test identifiers and an explicitly public deterministic test-only HMAC key.

Validation

• python -m pytest -q — 101 passed
• focused vector runner — all four cases matched expected outcomes
• Python compile check
• JSON parse check
• whitespace/diff check
• manual trust-boundary review and secret-pattern scan — no findings

Automated security scanners were not installed. python -m pip check reports pre-existing global environment conflicts for aider-chat/open-interpreter; this change adds no dependencies and the repository test suite passes.

Closes #69