feat(identity): add verified Runtime OBO SDK - #160

Summary

• add request-scoped verified user identity for AgentKit Runtime
• exchange verified ID tokens for target-bound Workload TIPs
• integrate with AgentkitAgentServerApp and protected downstream transport
• add explicit issuer/JWKS/audience/actor validation and release gates

Security boundary

• raw user ID tokens are private to request binding
• request lease covers TIP acquisition through downstream request completion
• unknown routes fail closed in identity mode
• IdentityClient is Volcengine-only experimental
• Runtime IAM to Workload ownership still requires server-side enforcement
• APIG/Broker product closure is not claimed

Validation

• source release set: 122 passed
• installed wheel: 122 passed on Python 3.10 and Python 3.12
• VeADK integration: 33 passed
• demo: 32 passed, 4 subtests passed
• Ruff, Twine, and pip check passed

Version

• 0.8.2 experimental