Include public audience in agent access

[chubes4]

Summary

• expand principal-aware access checks to include all applicable audience principals
• include audience:public by default for logged-in and anonymous principals
• add smoke coverage for logged-in users inheriting public audience grants

Testing

• php tests/agents-access-ability-smoke.php
• php tests/authorization-smoke.php
• homeboy test --path /Users/chubes/Developer/agents-api@fix-logged-in-public-audience-access
• homeboy lint --path /Users/chubes/Developer/agents-api@fix-logged-in-public-audience-access --changed-only

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (openai/gpt-5.5)
• Used for: Diagnosed the logged-in public-audience access gap, drafted the generic access-layer fix and smoke coverage, and ran local verification. Chris reviewed the direction and requested the PR.