Delegate AgentRegistryGrant resolver from bootstrap CLI

Continues #51 after #50 and #52.

Adds bootstrap `agent-machine registry resolve` usage text and delegates that command to the standalone `agent_machine.agent_registry` module.

Python CLI grant-store integration and package validator import/check remain tracked in #51.

Validated on PR head e054968 with validate and Trust Surface passing.

Author: mdheller

bin/agent-machine

@@ -44,6 +44,16 @@ delegate_python_cli() {
   return 127
 }
 
+delegate_registry_resolver() {
+  ROOT="$(repo_root_guess || true)"
+  if [ -n "${ROOT:-}" ] && [ -d "$ROOT/src/agent_machine" ]; then
+    PYTHONPATH="$ROOT/src${PYTHONPATH:+:$PYTHONPATH}" python3 -m agent_machine.agent_registry "$@"
+    return $?
+  fi
+  printf '%s\n' "agent-machine: Agent Registry resolver unavailable; repository package sources not found." >&2
+  return 127
+}
+
 print_help() {
   cat <<'EOF'
 agent-machine: SourceOS Agent Machine local node substrate CLI
@@ -59,6 +69,7 @@ Usage:
   agent-machine render quadlet <agentpod.json> [--compare <file>]
   agent-machine render k8s <agentpod.json> [--compare <file>]
   agent-machine policy resolve <agentpod.json> --policy-dir <dir> --deployment-receipt-id <id> [--expected-status allowed]
+  agent-machine registry resolve <agentpod.json> --grant-dir <dir> --requested-agent-identity-ref <ref> --session-ref <ref> [--expected-status active]
   agent-machine activate evaluate <agentpod.json> [policy.json] <grant.json> --deployment-receipt-id <id> [--policy-dir <dir>] [--storage-receipt-dir <dir>] [--pretty]
   agent-machine steer stub-response <request.json> [--status not_configured|noop] [--pretty]
   agent-machine steer serve-stub [--host 127.0.0.1] [--port 8080] [--status not_configured|noop]
@@ -282,6 +293,16 @@ case "$COMMAND" in
     shift || true
     delegate_python_cli policy "$@"
     ;;
+  registry)
+    shift || true
+    if [ "${1:-}" = "resolve" ]; then
+      shift || true
+      delegate_registry_resolver "$@"
+    else
+      printf '%s\n' "agent-machine: unsupported registry subcommand: ${1:-<missing>}" >&2
+      exit 2
+    fi
+    ;;
   activate)
     shift || true
     delegate_python_cli activate "$@"