Add per-agent HMAC secrets

[tattoosonmyskin]

Summary

Adds optional file-backed per-agent HMAC admission keys for the UDS governance path.

• introduces --agent-secret-dir / JINNGUARD_AGENT_SECRET_DIR
• loads per-agent secrets once at daemon startup; each regular file name is an agent_id
• uses the unsigned agent_id only to select a candidate key, then verifies the signed envelope before governance uses the payload
• requires the per-agent key when one exists for an agent_id; unconfigured agents keep the existing shared current/previous admission-key behavior
• documents the operator flow and updates the residual-risk boundary to describe this as file-backed HMAC v1, not tenant PKI

Validation

• cargo fmt --check
• cargo test -p ts_cli --bin ts_cli admission_key_tests
• cargo test -p ts_cli --bin ts_cli agent_identity_binding_tests
• cargo test -p ts_cli --bin ts_cli
• cargo clippy -- -D warnings
• cargo build -p ts_cli
• cargo test -p ts_checker
• git diff --check

Note: cargo build -p ts_cli emitted a non-fatal Cargo cache last-use warning from the sandbox's read-only global cache, then completed successfully.