fix(server): keep initAgent on registration authorization

[josjeon]

Summary

• Keep the complete initAgent create-or-refresh flow on the existing
  AGENTS_CREATE registration authorization.
• Remove the secondary AGENTS_UPDATE check that made an authenticated,
  non-admin SDK caller fail when it restarted with the same agent name.
• Add regression coverage for overwrite, no-op overwrite, strict registration,
  force-replace, and the built-in non-admin header-auth flow.

Closes #263.

Related downstream authorization work: rungalileo/orbit#2281.

Scope

• User-facing/API changes: callers allowed to register agents can initialize or
  refresh an existing same-name registration within their namespace, including
  the SDK-default overwrite flow and force-replace recovery.
• Internal changes: initAgent no longer performs a second authorization with
  AGENTS_UPDATE; its existing AGENTS_CREATE principal and target namespace
  checks remain in place.
• Out of scope: policy association, direct control attach/detach, and
  PATCH /agents/{name}. Those explicit management routes still require
  AGENTS_UPDATE and remain admin-only under the built-in header provider.

Risk and Rollout

• Risk level: medium. A registration-authorized caller can update an existing
  same-name registration within its namespace, including force-replacing
  corrupted registration data. This matches the endpoint's documented
  initialize-or-update contract; per-agent ownership remains a separate concern.
• Rollback plan: revert the commit to restore the secondary AGENTS_UPDATE
  authorization checks.

Testing

• Added or updated automated tests
• Ran make check (local make is unavailable because the configured Xcode
  developer toolchain fails to load). Ran the relevant commands directly:
  • focused authorization tests: 49 passed
  • complete server suite: 898 passed
  • server Ruff check: passed
  • server mypy check: passed
• Manually verified behavior (cross-repository DevStack verification will be
  completed with the downstream Orbit branch)

Checklist

• Linked issue/spec (issue Repeated initAgent registration incorrectly requires AGENTS_UPDATE #263 and downstream Orbit PR #2281)
• Updated docs/examples for user-facing changes (no prose change required;
  initAgent already documents initialize-or-update and idempotent behavior)
• Included required follow-up: validate repeated non-admin SDK initialization
  and denied explicit control mutations in the combined DevStack

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!