Fix AgentKeys per-operation authority and snapshot persistence

[web3blind]

Problem

Agent authorization currently treats a transaction as a single grant scope, allowing authority to spill across operations and excluding valid direct regular requirements. Persisted AgentKeys/key history also need safe snapshot and restart handling. This is a consensus-affecting change, not a wallet/UI feature.

Changes

• Check delegated signatures per operation and direct active/regular principal, preserving ordinary master, nested account-auth, mixed-principal and independent signature requirements. Allow scoped proposal_create/proposal_delete; deny delegated proposal_update and account_update, including invalid stored grants. Preserve existing wipe-on-authority-change behavior.
• Record key-history transitions and enforce the per-role cooldown through empty-authority transitions; validate and restore HF15 snapshot sections, signed head and hardfork marker before destructive import, and durably persist schema state across restart.
• Align signature-discovery/RPC behavior and EN/RU docs with chain policy. Include the isolated test-only dream-world fork path; production defaults do not enable it.
• Pin thirdparty/fc to the published FC dependency at 826353693ebdedaaf575e27c9414276bc5917e5d for the build fixes.

Verification

• On integrated head 1704986060363f094a00a8a342c733bf9ccee83f (upstream master 992b40aa): testnet vizd, consensus_sim_tests, and pm_agent_access_tests build with -j1; focused AgentKeys/key-history consensus 42/42 cases, 243/243 assertions; protocol 10/10 cases, 112/112 assertions; vizd --version and --help exit 0; git diff --check clean.
• On pre-integration feature code (snapshot acceptance at e5efbde3, before this latest-master merge): isolated mainnet-derived dream-world SDK/RPC testnet finalized 58/58 positive active/regular pairs and rejected 58/58 ungranted-signature attempts; four policy negatives, post-restart transfer, snapshot import/tamper/restart and 149/149 consensus cases, 1903/1903 assertions. Those live/full-suite results were not rerun on this integrated head; latest master changed block-archive wiring and docs, not AgentKeys consensus code.

Rollout: HF15 production timestamp remains 2026-10-05 00:00 UTC; this changes consensus relative to published 4.1.0 and requires explicit maintainer coordination for rollout. No production activation or deployment is claimed.

CI note: Docker publishing job failed before compilation at docker/login-action with Username and password required (upstream workflow credentials unavailable to this fork PR); this is not a build/test result. Consensus/PM CI is still running at the time of this note.

[web3blind]

Closing this combined proposal to separate minimal correctness/security fixes against current master from optional AgentKeys functionality. The existing branch is retained; replacement changes will preserve the minimalist protocol contract in the fixes PR and describe policy extensions separately.