Signed, self-contained snapshot of agent revocation state for sites that verify Auth Your Agent tokens locally (§9.2 hot-path-off-cloud).

A site fetches this on a 60s-ish interval and caches it. On token verification, if the token's rev_seq is present in this snapshot the site rejects without calling the cloud. The snapshot is signed with the same key as the access tokens (see /api/v1/jwks), so it is not forgeable.

revoked_agents is the union of agents with a non-ok global flag or a tombstone, plus the sites whose grant was revoked, tagged with the rev_seq they were revoked at (so an in-flight token issued before the revocation is still honored for its TTL — the standard §10.3 bound).