make agent keys honor the vault policy from python and node

[iicky]

• make agent-scoped keys honor the vault policy from python and node, not just the CLI — a policy vault is strict from every entry point
• block an agent from reading a forbidden secret via get()/export(), the same way murk agent exec does
• apply policy changes to live agents immediately — drop a tag and existing grants lose access on the next read
• leave operator (human) access unchanged

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.53%. Comparing base (d232a56) to head (38cc69c).
✅ All tests successful. No failed tests found.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.