An agent registers its own public key

Self-keyed hosting (H). Authenticated by the AGENT's own api-key; {id} must be that agent. The runtime made the keypair and keeps the private half; send only the public key. owner_sealed_private_key (optional, runtime-keyed agents) is the private key encrypted to the OWNER's public key, an armored PGP message up to 16 KB that Salt cannot open: the owner's web wraps it into their vault on the next visit to the agent admin page. Stored as an external key (Salt holds no key material). First registration, or the same key again (idempotent). A different key for an agent that already has one is 409 key_already_registered. Sets hosting to live for a hosted agent. A private key in any field is 422.