feat: give agents a Microsoft Entra identity across register, trace and evidence

[Paulo Lacerda (placerda)]

Closes #353, #354, #355.

The gap

A trace could say what an agent did, but not which registered agent did it.
Nothing in the release evidence pack tied runtime behaviour back to an
accountable owner in the tenant, so "who owns this agent" was answerable only
out of band. The three issues approach the same loop from different ends, which
is why they are implemented together rather than as three separate PRs.

The loop

Register. agentops agent register --sponsor <upn> creates or adopts a
Microsoft Entra agent identity blueprint and writes the resolved id to
.agentops/identity/agent-identity.json. It is idempotent: an existing
blueprint with the same display name is adopted, not duplicated. A sponsor is
mandatory, because an identity with no named owner is not governable, which is
the entire point of registering one. --dry-run resolves and prints the inputs
without contacting Microsoft Graph.

Stamp. _resource_attributes() in the telemetry bootstrap resolves the id
and sets it as the OpenTelemetry resource attribute gen_ai.agent.id on every
span. When no identity is registered the attribute is omitted entirely rather
than set to an empty string, so its presence is itself a usable filter in a
trace query.

Publish. The release evidence pack gains an agent_identity section
reporting the id and whether it came from the local record or the environment. A
missing identity produces a warning, not a blocker, because adoption has to be
incremental.

A read-only Doctor check reports registration posture under Security. It
resolves the local record first, at zero cost, and contacts Microsoft Graph only
when identity.verify is set in agentops.yaml.

Four deviations from the literal issue text

Each was forced by the existing code, not chosen for convenience.

Issue said	Implemented as	Why
Add a rule under a governance pillar	Standalone check called from analyzer.py	Every RULE_REGISTRY rule takes (payload: AzureResourcesPayload, source_name), and run_posture_check returns early when resources.account is None. A registry rule would silently never run for a workspace with no Azure account resolved. Follows the existing governance.py standalone pattern.
Register during agentops ship	agentops agent register, plus an opt-in step in the prod workflow templates	There is no ship command. Ship is a pillar, documented in docs/ship.md and materialised as workflow templates.
Category governance	Category.SECURITY	No governance member exists in the Category enum, and adding one would reshape every consumer of the catalogue for a single check.
(not anticipated)	New AgentIdentityConfig submodel in agentops.yaml	AgentOpsConfig sets extra="forbid", so the identity key was rejected outright until declared. A permissive Dict[str, Any] would accept sponser: silently and fail later with a misleading "sponsor is required", so the submodel forbids extras too.

Why the workflow step is off by default

The generated production workflows carry the registration step gated on the
AGENTOPS_IDENTITY_SPONSOR repository variable. It writes to a tenant, so it
should never be the default behaviour of a workflow that AgentOps generates for
someone. Setting the variable to the sponsor's UPN turns it on.

Agent 365

The Agent 365 ingestion API is not public, so nothing here depends on it. The
handshake is documented instead, in docs/observe.md, so the id can be
correlated by whoever consumes the traces.

Tests

65 new unit tests across six files:

File	Tests
test_agent_identity_service.py	28
test_agent_checks_agent_identity.py	13
test_cli_agent_register.py	8
test_evidence_pack_agent_identity.py	7
test_telemetry_agent_id.py	5
test_agentops_config_identity.py	4

Full suite: 1271 passed, 6 skipped. Both generated prod workflow templates
(placeholder and azd modes) were regenerated and verified to parse as valid
YAML with the identity steps correctly gated.

Docs

• docs/observe.md — new "Agent identity on traces" section with the
  three-step handshake, the identity config block, and a KQL query.
• docs/doctor-checks.md — graph added to the data sources table, three
  agent_identity.* rows in the Security catalogue, plus a note that the checks
  are read-only.
• docs/ship.md — "Giving the agent its own identity" under Identity and
  access, explaining the opt-in workflow variable.