fix: honor wrapped preview policy in owner agent UI - #64

The owner Agent access page returns unavailable when a host wraps TenantPolicy with current durable preview-domain checks. Add optional ManagementOptions.Tenants for immutable UI declarations, retaining the existing direct-policy fallback. Every displayed tenant/audience proposal still passes both the required wrapped service policy and current owner membership; the declarations confer no authority.

Require the same current service policy before revocation, alongside the existing owner, Origin/Host, confirmation, version and audit checks. The runbook explains that cleanup while the preview gate is closed requires a current approved preview declaration or separately approved offline cleanup. List/create/read, exchange and resource authorization continue using the required wrapped policy.

Validation: focused offline native go test -mod=readonly -race -p 1 -count=1 -run '^(TestOwner.*|TestDeclarativeTwoTenantAccessAndIsolation)$' ./agentidentity passed in 1.256s, using existing Go/module caches. Tests exercise two declarations, dynamic preview-to-live changes, owner membership limits, unavailable gates, missing UI declarations, denied management mutations and previously issued token/exchange denial. gofmt and git diff --check passed. No PostgreSQL, full build, dependency/workflow/SQL changes or activation.

This is a draft follow-on stacked on PR63's frozen 169e5e6e2920a60728f3d8e83980ec52006b49fc implementation, which remains unchanged. Review the three-file delta; root will independently review the exact frozen follow-on head before any adoption.