feat(#4520): AGNTCY DIR directory client — agents-kt-dir module

[Skobeltsyn]

Summary

AGNTCY DIR directory client — the last core subtask of epic #4517. DirClient publishes/discovers OASF records in the AGNTCY DIR content-addressed directory over generated grpc-kotlin StoreService stubs.

DirClient.connect("localhost", 8888).use { dir ->
    val cid = dir.push(agent.toOasfRecord(version = "1.0.0"))  // publish → CID
    val json = dir.pull(cid)                                    // discover by CID
}

What landed

• DirClient — push/pushAll (OASF JSON → CID), pull (CID → JSON), lookup (metadata), delete; AutoCloseable.
• Record body = google.protobuf.Struct (JSON is the contract, no OASF protos) via protobuf's canonical JsonFormat — whole numbers stay integral ({"id":1003}, tested).
• Vendored protos: trimmed but wire-compatible — same package/service/RPC/field numbers + types as upstream agntcy/dir; the buf.validate field options (compile-time only) and unused referrer RPCs dropped, so we avoid the buf/validate proto closure while staying on-the-wire identical.
• Auth — plaintext (dev) / TLS / OIDC bearer built in; SPIFFE/mTLS via a caller-supplied ManagedChannel (fromChannel).
• New feature module agents-kt-dir (agents_engine.agntcy.dir) so the grpc/protobuf/netty graph stays out of core (the rag/identity pattern). Codegen via the protobuf Gradle plugin — verified working on Gradle 9.5 / Kotlin 2.4.

Dependency verification

Platform-specific protoc / protoc-gen tool binaries are trusted by group in verification-metadata.xml (build tools, per-OS classifiers — avoids needing a separate checksum per CI platform); the runtime grpc/protobuf/guava jars are fully checksummed (+328 entries, additive). whisper-jni lockfile drift excluded.

Gates

4 hermetic tests (in-process gRPC fake StoreService round trip — no daemon). Full ./gradlew build green (dir module + detekt + DocsConsistency + dependency verification). README + CHANGELOG + PRD §12.6 + internals adjunct updated.

RoutingService/SearchService (network discovery) + OCI referrers are documented follow-ups; the content-addressable store client is the foundation. Closes #4520.

CodeQL java-kotlin expected-red on Kotlin 2.4 (codeql#21938); build is the gate.

🤖 Generated with Claude Code