docs(brand-protocol): building-a-brand-agent Tier-2 implementation guide for verification tools

[bokelley]

Follow-up from PR #4540 (brand verification RFC).

The gap

`docs/brand-protocol/building-a-brand-agent.mdx` covers Tier 1 (`get_brand_identity`) and rights tasks today. The verification surface from PR #4540 — `verify_subsidiary_claim`, `verify_property`, `verify_trademark` — is documented per-task but doesn't yet have implementer-side guidance.

What the implementation guide should cover

• Capability declaration via `get_adcp_capabilities` `supported_tasks`
• State model the agent maintains internally (portfolio of owned subsidiaries, properties, trademarks, pending-claim queue)
• Aging contract for `pending_review` → terminal-state lifecycle
• Signing setup with separate `adcp_use: response-signing` JWK
• Rate-limiting reference pattern with `Retry-After`
• Cache headers per status
• Public-vs-authorized response shaping
• Notification loop integration (email portfolio team, ticket creation, Slack)
• AAO-hosted shortcut for members

Code samples

TypeScript-first, matching existing Tier 1 examples.

Related

• docs(brand-protocol): RFC — brand verification surface (verify_subsidiary_claim / verify_property / verify_trademark) #4540 — the RFC that defines the contract this guide implements
• spec: typed verification_endpoint + payload schema for self-healing notification #4521 — the original issue