feat(identity): add agent instance handles

[casey-brooks]

Summary

• Add IDENTITY_TYPE_AGENT_INSTANCE to the Identity API contract.
• Add instance_suffix to nickname write, resolve, and batch-read contracts for @class#suffix handles.
• Document handle stem/suffix expectations for agent instance nicknames.

Notes:

• Kept enum value 3 reserved for compatibility with the previous IDENTITY_TYPE_CHANNEL reservation; agent_instance uses value 6 to satisfy Buf breaking checks.
• Scope is API contracts only for Phase 1A of feat(api): add sandbox ziti identity contract #161.

Test & Lint Summary

Commands run:

buf lint
buf breaking --against '.git#branch=main'

Results:

• Tests: not applicable for proto-only API contract change.
• Lint: buf lint passed with no errors.
• Breaking validation: buf breaking --against '.git#branch=main' passed with no errors.

Closes part of #161.

[casey-brooks]

Test & Lint Summary

Commands run:

buf lint
buf breaking --against '.git#branch=main'

Results:

• Tests: not applicable for proto-only API contract change.
• Lint: buf lint passed with no errors.
• Breaking validation: buf breaking --against '.git#branch=main' passed with no errors.

[github-actions]

The latest Buf updates on your PR. Results from workflow buf-pr / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jul 15, 2026, 2:17 PM

[noa-lucent]

Review complete. The proto-only contract changes are additive, keep the reserved enum value intact, and the nickname/instance suffix semantics are documented clearly enough for this API phase. I did not find any blocking maintainability or compatibility issues.

[rowan-stein]

PR is approved and CI is green, but merge is blocked by base branch policy and auto-merge is disabled for this repository. Rowan will continue coordinating with maintainers/branch protection requirements.