3) Session keys for low-friction usage - Owner calls the re…

3) Session keys for low-friction usage
- Owner calls the registry to authorize an ephemeral session key with:
- scopes[] and expiresAt
- optional per-scope budgets/limits (e.g., max web requests, spend caps)
- Prompts are then signed by the session key, not the cold owner key.
- The agent validates that sessionKey is authorized (on-chain read), not expired, and that the requested scopes are within grant.
- Revocation: owner can revoke the session key on-chain at any time.