Agent Binding
link-binding: the agents bound on this machine and their keys, kept
outside every sandbox, which every bridge checks a call's proof against
(Bridges).
Binding writes an agent's key; unbinding revokes it.
The machine's keyring
The agent's key is the one made at each start, its endpoint_key.
lnk agent start binds it in the machine's keyring,
~/.lnk/agents/.keys/<agent id>.json (700 folder, 600 files,
link_bridge::Keyring), and lnk agent stop and remove unbind it: a
key no longer there proves nothing.
A binding for while it answers
A machine that runs an agent only while it answers binds what runs it to
the agent for that time, with a key made for the binding, and unbinds it
when it stops (link_bridge::Unit).
A passable keyring
Where each agent's helpers run as a user of their own, outside its
sandbox, a machine keeps a passable keyring (Keyring::passable): its
folder 711, so no one but its user lists the agents.
Keyring::bind_shared
An agent bound with Keyring::bind_shared has its file 640, of one
group, so the helpers in that group read that agent's key and no other.
A bind again sets the group again, and an unbind removes the file,
before the next agent's helpers are given that group.