Surface the job authority descriptor to subscribers (§7.6: lease_constraints + budget on job.subscribed)

[nficano]

Surface the job authority descriptor to subscribers (§7.6)

Align this SDK with spec PR agentruntimecontrolprotocol/spec#1 and the
reference implementation agentruntimecontrolprotocol/typescript-sdk#149.

Background

job.subscribed should give an observing principal the non-secret
authority descriptor for a job, so a dashboard/console can render the job's
authority surface (expiry clock, budget gauge) without being the submitter.
Most SDKs currently send only { job_id, current_status, agent, lease, parent_job_id, trace_id, subscribed_from, replayed }.

Required changes

1. Schema — job.subscribed.payload MUST accept (all OPTIONAL):

   • lease_constraints — currently { "expires_at": "<rfc3339>" } (§9.5)
   • budget — per-currency counters, e.g. { "USD": 3.58 } (§9.6)
   • credentials — array of provisioned credentials (§9.8), submitter-only

2. Runtime / server — when building job.subscribed:

   • include lease_constraints when the job has them;
   • include budget from the job's current per-currency counters (mirror
     how job.accepted builds budget, but use the live counters rather than
     the initial ones); omit when empty;
   • include credentials only when the subscribing principal IS the job's
     original submitter, and redact for every other authorized observer (§14).

3. Client — expose the descriptor on the value subscribe() returns (the
   subscription handle): current_status, agent, lease, lease_constraints,
   budget, credentials. Some SDKs already parse these into internal state but
   never surface them to the caller.

Security (§14)

credentials.value is real spending authority. Subscribers that are not the
submitter MUST NOT receive credentials. Hard requirement, unchanged.

Acceptance criteria

• job.subscribed schema accepts the three optional fields.
• Runtime populates budget (current counters) + lease_constraints for all authorized subscribers.
• Runtime includes credentials only for the submitter; redacts otherwise.
• Client subscription handle exposes the full descriptor.
• Test: an observer (different principal) subscribing to a job with a
  cost.budget lease + expires_at receives budget and lease_constraints
  but NOT credentials. (Reference test in typescript-sdk#149.)

Compatibility

Backward-compatible — additive optional fields only. Ship as a minor release.

References

• Spec §7.6 — agentruntimecontrolprotocol/spec#1
• Reference impl (TypeScript) — agentruntimecontrolprotocol/typescript-sdk#149