feat: re-check central RTC authorization right before every write (GET /v1/agents/me/authorizations), human labels on the cClassTrib control page, final corpus/scale evidence; 1.2.1

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

central/app/api.py

@@ -252,6 +252,16 @@ def router(session_factory, bootstrap_token):
         finally:
             session.close()
 
+    @routes.get("/agents/me/authorizations")
+    def agent_authorizations(identity=Depends(principal)):
+        """Current central RTC write authorization of the authenticated Agent's own installation (read by the Agent right before it writes). Nothing else is exposed."""
+        session, agent = identity
+        try:
+            installation = session.scalar(select(Installation).where(Installation.agent_id == agent.id))
+            return job_authorizations(session, installation) if installation is not None else {"rtc_write_mode": "DISABLED"}
+        finally:
+            session.close()
+
     @routes.get("/agents/me")
     def agent_status(identity=Depends(principal)):
         session, agent = identity