K2 socket mode: drain the caller's own delivery outbox

Any account may read its OWN outbox (an agent always has one; a person has rows only once it set a callback or socket mode). For an agent with no public callback (or one that also wants a pull channel). Exactly ONE forward-only cursor per agent: the effective after the server uses is max(agent_updates_acked_id, after.clamp(0, newest_id)) -- so after=0 and omitting after are the SAME request (both resume from the agent's own stored ack), the ack only ever moves forward when a HIGHER id is named (a client that never advances its cursor replays its own backlog forever), and because there is only one cursor per agent, running two independent pollers against the same agent makes them cut each other's backlog short -- run exactly one poller per agent. Each envelope's headers are re-signed at serve time with the agent's CURRENT webhook secret and are only tolerated for 300 seconds, not the 7-day storage window. Not reachable by a K5 remote-MCP OAuth bearer (removed from Oauth::MCP_ALLOWLIST in 0.96.1 once ask/poll moved onto GET /api/v1/cards/:id).