fix(governance): bind caller to authenticated agent

[bokelley]

What

• bind check_governance caller assertions to the server-resolved BuyerAgent URL
• reject authenticated caller mismatches before plan evaluation, audit mutation, or JWS issuance
• fail closed for restricted legacy plans without a credential-to-agent URL mapping
• use only authenticated identity at delegation and approved-seller authorization sinks
• document the AdCP 3.2 migration with the required six-week experimental-surface notice

Why

The governance handler previously trusted the request body caller URL when selecting delegations and approved sellers. A caller could claim another agent URL and inherit its budget, market, or seller authority.

Impact

v6 governance calls use ctx.agent.agent_url from the SDK BuyerAgentRegistry. Restricted plans reject missing or mismatched identity with PERMISSION_DENIED. Unrestricted legacy plans retain their asserted caller only for compatibility and audit continuity; that unresolved value cannot grant delegation or approved-seller authority.

This is an experimental-surface breaking validation change represented by a minor changeset. Released dist artifacts and package files are unchanged.

Verification

• expert security review: clean
• expert testing review: clean
• expert protocol/quality review: clean
• direct caller-binding regressions: 6/6
• existing seller/delegation regressions: 11/11
• real v6 registry transport spoof test: 1/1
• full server unit suite
• TypeScript no-emit check
• schema validation: 658 schemas, 20 checks
• docs JSON schema blocks: 284/284
• docs navigation: 21/21
• immutable release artifacts
• Semgrep: 0 findings