feat(identity): per-scope network identity plane (slices 1-5)

Fingerprint map + pure resolver (account umbrella / key-level scope
rule), live Warp provider on warp-* structures, broker lifecycle
(up/down/cycle/exec/routes/status/bind), wireguard+socks boilerplate
stubs, agent-manager bind integration. CLI carries emails and
fingerprints only; key bytes never appear. 41 committed tests.

.gitignore

@@ -6,6 +6,7 @@ logs/
 pipelines.json
 followups.json
 siphon-watermarks.json
+identity-state.json
 review/
 
 __pycache__/