feat(directive): implement BRIDGE-WP-0004 AccessManagementDirective alignment

- ActorType enum (adm/agt/atm) replaces actor_class string; config validates
  naming convention (adm-*/agt-*/atm-*) with hard ConfigError on mismatch;
  legacy 'human'/'automation' values accepted with DeprecationWarning
- cert_command: pluggable shell string run before each SSH launch; cert written
  to state dir; -i cert appended to SSH command alongside -i key
- TTL-aware cert refresh: parses Valid-to via ssh-keygen -L; pre-emptive restart
  5 min before expiry (no backoff, no attempt increment); CERT_EXPIRING logged
- CertAcquisitionError: cert failures trigger normal backoff/retry loop
- cert_identity: Key ID parsed from cert and recorded in BRIDGE_CONNECTED event
- bridge cert-status: new CLI command; exit 1 on expired cert; --json flag
- 233 tests passing, ruff clean

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/bridge/models.py

@@ -15,6 +15,16 @@ class BridgeState(str, Enum):
     FAILED = "failed"
 
 
+class ActorType(str, Enum):
+    ADM = "adm"  # human operator
+    AGT = "agt"  # LLM-powered autonomous agent
+    ATM = "atm"  # deterministic script / pipeline
+
+
+class CertAcquisitionError(Exception):
+    """Raised when cert_command fails to produce a certificate."""
+
+
 @dataclass
 class ReconnectPolicy:
     max_attempts: int = 0  # 0 = infinite
@@ -41,10 +51,11 @@ class TunnelConfig:
     reconnect: ReconnectPolicy = field(default_factory=ReconnectPolicy)
     health_check: Optional[HealthCheckConfig] = None
     direction: str = "reverse"  # "reverse" (-R) or "local" (-L)
+    cert_command: Optional[str] = None
 
 
 @dataclass
 class ActorInfo:
     name: str
-    actor_class: str  # "human" or "automation"
+    actor_type: ActorType
     description: str = ""