feat(identity): per-scope network identity plane (slices 1-5)

Fingerprint map + pure resolver (account umbrella / key-level scope
rule), live Warp provider on warp-* structures, broker lifecycle
(up/down/cycle/exec/routes/status/bind), wireguard+socks boilerplate
stubs, agent-manager bind integration. CLI carries emails and
fingerprints only; key bytes never appear. 41 committed tests.

identity-map.json

@@ -0,0 +1,22 @@
+{
+  "_comment": [
+    "Identity map: API-key fingerprints to account origins (NO key material).",
+    "Checked in. Fingerprints are sha256 of the raw key bytes (${identity-resolve.py fp}).",
+    "Resolution rule: api_key -> account_origin(s); one origin rolls scope UP",
+    "to the umbrella account; two or more (openrouter + provider) keeps scope",
+    "DOWN at the key itself. Keys under top-level '_' entries are ignored.",
+    "Schema: accounts: { email: { keys: [ {fp, origins:[email...], label?} ] } }"
+  ],
+  "_example": {
+    "uma@example.com": {
+      "keys": [
+        {"fp": "sha256:EXAMPLE-replace-with-real-fingerprint",
+         "origins": ["uma@example.com"], "label": "main"},
+        {"fp": "sha256:EXAMPLE-openrouter-key-fingerprint",
+         "origins": ["uma@example.com", "provider-acct"],
+         "label": "openrouter"}
+      ]
+    }
+  },
+  "accounts": {}
+}