refactor(agent): model finalized publish author selection explicitly

[branarakic]

VM publish options could combine an authoritative author override with a caller hint or resident-author selection. The exported PublishAuthorSelection makes those choices exclusive for the nested SDK API and is shared by immediate publishing, queued intents, and daemon routes.

{ authorSelection: { mode: 'author', agentAddress: author } }
{ authorSelection: { mode: 'callerHint', callerAgentAddress: curator } }
{ authorSelection: { mode: 'residentAuthor', selectedAuthorAgentAddress: member, callerAgentAddress: curator } }

Omitting the selection uses the node identity as the caller hint. Deprecated flat options remain supported, including optional-string annotations and released empty-field behavior. Conflicting nested/flat combinations fail before lookup. An authoritative override conflicts with any supplied resident selector, including empty or null values.

A pure compatibility parser snapshots the public identity fields into a typed plan. Exhaustive resolution chooses the authoritative author, caller-preferred resident author, or explicit resident author and returns the enqueue caller separately. The released deep resolver adapts its legacy fields into the same typed resident-selection contract. One canonical store resolver owns candidate discovery and selection; malformed selectors retain the existing not-resident error and candidate list.

Enqueue captures the subgraph before lookup and uses that same coordinate for seal/head validation and request construction. Later option mutations cannot change the queued author, caller, or scope. Explicit resident publishing fails when the coordinate is not finalized; the released deep resolver preserves its undefined result for invalid names.

Normalization and canonical resolution remain behind the blocked dist/internal/* package boundary. The released deep resolver reads only its declared legacy fields. Daemon routes emit nested selections and retain the caller separately through registration retries. The README documents the additive migration.

Closes #1781.

Validation:

• 101 agent tests and 77 CLI tests pass across author selection, source/published resolver compatibility, finalized-agent lanes, HTTP errors, and queued caller attribution.
• Tests cover nested and deprecated flat options, empty fields, conflicting selections, malformed-selector candidate diagnostics, private-field smuggling, and author/caller/subgraph mutation during lookup.
• Public type checks preserve released option bags and reject conflicting public selections, incomplete internal plans, and unparsed resident selectors. Internal models remain inaccessible through package exports.
• Agent dependency/build checks, public package-root checks, lint, and merge compatibility with current canary pass. Candidate-discovery queries are byte-identical to the previous head.
• Focused coverage across the three author-resolution modules is 94.89% statements, 91.34% branches, and 100% functions; repository CI supplies the full package gate.