Complete AgentRegistryGrant CLI and activation resolver capture

[mdheller]

Summary

Completes the remaining current-main capture for SourceOS-Linux/agent-machine#51 without replaying the stale #30 cli.py blob.

Changes

• Adds Python CLI agent-machine registry resolve through python -m agent_machine.cli registry resolve.
• Reuses the current agent_machine.agent_registry resolver module rather than duplicating resolver semantics.
• Adds activation evaluation support for resolving AgentRegistryGrant from --grant-file / --grant-dir / --grant-id.
• Defaults --requested-agent-identity-ref, --workroom-ref, and --topic-ref from AgentPod.workload when present.
• Extends make validate-agent-registry to prove the Python CLI registry resolver path.
• Extends make validate-activation to prove the policy resolver + grant resolver activation path.

Boundary

This is resolver and validation wiring only. It does not add runtime activation, model loading, network calls, registry service calls, host mutation, or credential access.

Validation target

make validate-agent-registry
make validate-activation
make validate

Capture posture

This should close the remaining functional items from #51:

• Python CLI registry resolve command.
• activation evaluation grant-store args.

The original #30 branch remains stale and should not be blob-replayed over current main.