Verify guest agent password

Verifies the supplied password against the agent’s bcrypt hash for password-gated guest agents. Rate-limited per client IP (shared with the run endpoint) — every call (including failures) consumes the limiter budget to prevent bcrypt oracle attacks. On success returns 204 with no body; the client should then pass the verified password in x-guest-password on run calls. Returns 404 when the agent is not found, not guest-published, or not in password auth mode. No authentication is required.