Add attenu-guard: in-process permission enforcement across sub-agent handoffs, offline-verifiable audit log

[rafaelasor]

Adds one row to Provenance, Instrumentation & Observability and one bullet to Agent Identity & Credentials.

• attenu-guard — https://github.com/attenu-io/attenu-guard (Apache-2.0, on PyPI as attenu-guard). In-process enforcement of per-agent permissions on every tool call and every sub-agent handoff: the child's permission set is a computed subset of the parent's, with chain ceilings and cascade revocation; every decision is written to a hash-chained, Ed25519-signed audit log that attenu-guard verify checks offline from the bundle alone (integrity, child ⊆ parent, containment). Zero-dependency core; adapters for LangGraph, CrewAI, Google ADK, OpenAI Agents SDK, Claude Agent SDK, Pydantic AI, AutoGen, smolagents, AWS Strands, LlamaIndex, Semantic Kernel, Agno, plus an MCP server-side verifier example.
• The delegation-token wire format is written up as a draft in Internet-Draft format (not yet submitted to the IETF); the bullet says so and sits next to the klrc / AAuth / Agent Native Authorization entries it is meant to converge with.

Disclosure: I maintain attenu-guard. Happy to trim the row or move it if another section fits better.

[rafaelasor]

Checking in after a week. If the entry belongs in a different section or needs shorter wording, tell me and I will change it.

[rafaelasor]

@bureado The IETF draft this PR adds is at -01 now, posted 2026-09-03: https://datatracker.ietf.org/doc/draft-asor-wimse-agent-delegation-chain/01/ . Point the description at that revision if it is useful, or reword the entry however you prefer.