Add audience principals for agent access

[chubes4]

Summary

• Adds audience principals so host apps can authorize non-user visitors such as audience:public.
• Extends agent access grants and stores with an optional principal-aware contract.
• Allows access abilities to resolve anonymous public principals and list only explicitly granted agents.

Testing

• php tests/execution-principal-smoke.php
• php tests/agents-access-ability-smoke.php
• php tests/authorization-smoke.php

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Implemented and tested the audience-principal access path under Chris's direction.