Check a brand against carrier review

Also checks agent artwork when logoUrl/bannerUrl are given, which is the point: the only other place artwork is inspected is PATCH /agents/{id}/google, and that requires the irreversible sync-google — which is the step that sends the artwork. Checking here is the last moment a mistake is free.

Public and unauthenticated. Carrier review rejects on a small, predictable set of issues — missing privacy or consent disclosures, non-SMS "terms", brand/entity mismatch, too-new domains. A clean submission lands in days; one rejection costs weeks. Also generates the policy text a brand is missing.