pub fn check_agent_keys(vault: &Vault, keys: &[String]) -> Result<(), MurkError>Expand description
Check that every key in keys is permitted to agents by the vault’s policy.
No policy → all keys allowed (backward compatible). With a policy, a key is
allowed only if its schema carries at least one of the policy’s
agent_allow_tags. Fails closed: an unknown key (no schema entry) or a key
with no matching tag is refused. Returns an error naming every forbidden key
and the allowed tags, so the caller’s message is actionable.