feat(agent): sign in with a handle, discovering the PDS from its DID document

[ewanc26]

What this changes

New wf_agent_login_discovered: resolves a handle (DNS TXT, then /.well-known/atproto-did) or takes a DID, reads its #atproto_pds endpoint, points the agent there, and logs in at that PDS. Before this, the first login went to the host the caller typed, so an account on another PDS could not sign in unless the user typed its PDS.

Verification

test_agent_login_discovered (argument checks, and an unresolvable .invalid handle fails with no PDS reported): ctest passes on the host build. The network path is not run here; the consumers' sign-in is the end-to-end check.

Docs

Header comment on wf_agent_login_discovered; CHANGELOG entry.

Changelog: CHANGELOG.md

Checklist

• CI is green (CI gate and flow / conventions)
• No secrets, tokens or signing keys in the diff
• Tests added or changed with the behaviour; none skipped, disabled or deleted

🤖 Generated with Claude Code