feat(agentctl): governed web acquisition as first-class acquire command

[mdheller]

Summary

Makes governed web acquisition a first-class TurtleTerm command:

turtle-agentctl acquire --url <URL> [--account ..] [--tier ..] [--seeds ..] [--enrich]

It routes through turtle-agentd to Agent Machine's POST /api/acquire, which records a governed run and dispatches to the acquire-worker — failing closed when Agent Machine is unreachable. The path mirrors the existing noetica-query transport end to end; no new transport was invented.

Changes

• turtle-agentctl: new acquire subparser (--url required, --account, --tier, --seeds repeatable/comma-separated, --enrich) that builds {"action":"acquire","url":..,"account_class":..,"tier":..,"seeds"?,"enrich"?}. Top-of-file help updated to list acquire.
• turtle-agentd: routes action acquire → POST {agent_machine_url}/api/acquire with body {url, accountClass, tier, seeds?, enrich?} (reuses agent_machine_url() / SOURCEOS_AGENT_MACHINE_URL and the shared _http_post helper). Writes a governed receipt and returns the acquisition result + provenance/decision. Fail-closed: unreachable Agent Machine yields decision=deny, status=error, status=blocked_offline, and no admission.
• skill manifest (turtle-agent-machine-bridge.json): adds agent-machine.acquire command, web-acquisition intentTag, and acquisition-provenance-receipt artifact output.
• tests: unit tests for the route (mock POST hits /api/acquire with the governed body; fail-closed on unreachable; --url required) plus an end-to-end agentctl→agentd request-build/dispatch check.

Verification

• python -m pytest assets/sourceos/tests/test_turtle_agentd.py -q → 8 passed
• python -m py_compile on both scripts → OK
• Skill manifest JSON validated
• End-to-end offline run returns kind=acquisition_result status=error reachable=False status_label=blocked_offline decision=deny

No existing tests were weakened.