#22524 Read receiving policy through the VM agent

The VM agent reads receiving policy using its original enrollment and protected keys. One deadline bounds authentication, policy and keyset reads; the existing agent socket returns only public authority.

43 focused Linux tests, fmt/Clippy and Rust 1.91 checks pass. macOS is queued. Supervised receiver composition remains a follow-up.

Changelog

none