eval: request-bound credential proof (DPoP-style) for agent tool calls (decision record)

[tcconnally]

Summary

Decision record docs/decision-record-request-bound-credential-proof.md (perseus-agent-core #13):

• Decision: adopt the request-bound proof-of-possession concept at the tool boundary and in the credential broker, as a lightweight binding — not the OAuth DPoP stack.
• Session-bound vs request-bound comparison table covering replay, tamper, and cross-request leakage.
• Placement: the tool boundary signs canonicalized request context (actor, boundary, tool, policy-relevant argv, credential id, one-time nonce, expiry); the broker verifies at the phantom-token swap (feat: phantom-credential brokering for tool execution (credential never enters the child) #11) and fails closed.
• Receipts without secrets: request binding id, binding digest, credential id, proof outcome, expiry — hash-only fields, never the credential value, never raw argv bodies.
• Non-goals: no OAuth-stack mandate; no claim DPoP maps 1:1 onto the manifest authority model.

Follow-up implementation issue opened for the binding layer (this sprint), referencing this record and #11.

Gates (run locally, actual output)

• git diff --check → clean
• npx markdownlint-cli --disable MD013 MD033 MD024 MD025 MD060 -- docs/decision-record-request-bound-credential-proof.md → exit 0 (LINT-OK)
• Repo test suite (pytest) unaffected — docs-only change; CI runs on the PR head.

Acceptance criteria

• Decision record saved in the repo docs with a recommendation and rationale
• Replay/tamper cases explicitly addressed (dedicated section, four cases)
• Non-goals: no OAuth-stack mandate; no claim that DPoP maps 1:1 onto the manifest authority model

Closes #13