ship: auto-register agent identity blueprint on ship

[placerda]

Context

An agent produced by the accelerator is invisible to the Agent 365 control plane until someone manually registers it in the Entra admin center. The natural moment to register is at ship time.

Goal

Add an opt-in step to agentops ship that creates (or updates) the agent identity blueprint in Entra and records the resulting appId in the deploy manifest.

Scope

• New --register flag on agentops ship (opt-in, off by default).
• Idempotent: if a blueprint already exists for the agent, update instead of creating a duplicate.
• Persist the returned appId in the manifest/artifact.

Approach

• POST https://graph.microsoft.com/v1.0/applications/ with body {"@odata.type": "Microsoft.Graph.AgentIdentityBlueprint", "displayName": ...} and header OData-Version: 4.0.
• App-only auth with AgentIdentityBlueprint.Create so it runs in CI.
• Sponsor is required (from config); owner optional.
• Reuse the Graph client introduced by the doctor check.

Acceptance criteria

• ship --register creates the blueprint and persists appId.
• Re-running is idempotent (no duplicate blueprint).
• Missing role/consent => clear, actionable error, not a stack trace.

Notes

• Spike confirmed: AgentIdentityBlueprint.Create is published (delegated + application) on Graph v1.0.
• Requires a one-time admin consent in the tenant.
• Depends on the Graph client from the doctor posture check issue.

Out of scope

• Governance enforcement (Conditional Access, Purview) which stays Microsoft-owned.