doctor: Agent 365 registration posture check

[placerda]

Context

agentops doctor scores an agent against WAF posture rules but has no visibility into whether the agent is registered in Microsoft Agent 365 / has an Entra Agent ID. This is the first question enterprises ask: "is my agent known to the control plane?"

Goal

Add a read-only doctor posture check that reports whether the agent has an Entra Agent ID and is present in the Agent 365 registry.

Scope

• New posture rule under the governance pillar.
• Outcome: pass (registered), warning (no identity / not registered), with a WAF link and a deep link to the Entra agent identity.
• Read-only. No writes, no judge-model call (source-based).

Approach

• Add the rule in src/agentops/agent/checks/posture_rules/, register it in RULE_REGISTRY, and add the human-readable spec in catalog.py.
• Call Microsoft Graph v1.0 app-only using AgentIdentityBlueprint.Read.All / AgentIdentity.Read.All.
• No identity found => warning: not registered with remediation text.

Acceptance criteria

• agentops doctor lists the new rule.
• Registered agent => pass; unregistered => warning with actionable remediation.
• Missing consent/permission fails with a clear message, not a stack trace.

Notes

• Spike confirmed: AgentIdentity* read scopes are published on Graph v1.0 in a real tenant (not gated).
• Standalone. No dependency on other issues.

Out of scope

• Any write/registration (that is a separate issue).
• Conditional Access / Purview / runtime enforcement (Microsoft-owned).