feat(registry): chrysalis agent designer + catalog auto-install

[toadkicker]

Summary

• Wire orphaned `/agents/design` route: nav sidebar link + Agents page `+ Design Agent` CTA
• Complete Sign & Register flow in `AgentDesignerPage` (`spawn_local` async: `sign_advertisement` → `register_agent_json`)
• Add `install_catalog_agents()` server fn + `CatalogInstallCard` in Settings for one-click catalog seeding
• DRY refactor: `DynamicAgentDef::to_signed_advertisement()` eliminates duplicated deterministic-key logic
• First-boot TOML catalog seeding in `main.rs` via `PAP_CATALOG_PATH`
• `Dockerfile.ci-chrysalis`: TOML catalog files in runtime image + `PAP_CATALOG_PATH=/app/catalog`

Test plan

• `chrysalis-integration` E2E suite: 22/22 passing against Docker CI image (305 agents seeded at first boot)
• CI: all jobs pass (check, test, test-registry, clippy, fmt, docker-workspace, chrysalis-e2e, chrysalis-e2e-tier2)

🤖 Generated with Claude Code

[github-actions]

Benchmark Regression Report

PAP Protocol Benchmark Regression Check
========================================
Baseline: .bench-baseline/baseline.json
Threshold: 30%

  ed25519_keypair_generation                19.7 µs  (baseline: 17.2 µs, +14.9%)  [ok]
  did_key_derivation                         1.5 µs  (baseline: 1.4 µs, +10.7%)  [ok]
  mandate_create_sign                       24.0 µs  (baseline: 22.1 µs, +8.7%)  [ok]
  mandate_chain_verify_depth3              125.5 µs  (baseline: 111.3 µs, +12.7%)  [ok]
  sd_jwt_issue_5claims                      27.9 µs  (baseline: 25.3 µs, +10.6%)  [ok]
  sd_jwt_verify_disclose_3of5               44.3 µs  (baseline: 39.0 µs, +13.3%)  [ok]
  session_open_full_lifecycle              112.6 µs  (baseline: 98.7 µs, +14.0%)  [ok]
  receipt_create_cosign                     47.9 µs  (baseline: 43.7 µs, +9.6%)  [ok]
  federation_announce_local                 56.3 µs  (baseline: 50.6 µs, +11.2%)  [ok]

All benchmarks within 30% of baseline.

_{Threshold: 10% regression vs baseline from main}