Governance-as-a-service for Semantic Kernel agents. Cryptographic action verification (ALLOW/CLAMP/DENY), hash-chained provenance, intent-command binding, and compliance bundles. SK agents taking real ...