JpaAgentVisibilityResolver

JPA-only AgentVisibilityResolver: a read view over the shared database, usable by any plane that does not own the file-backed catalog (data plane, scheduler).

Declared as a plain class rather than a @Component so the control plane — which has its own authoritative catalog-backed resolver — never ends up with two beans of this type. Non-control planes declare it as a @Bean in their own configuration.

Visibility mirrors the control plane's catalog semantics without any file-backed state:

• Global agents are detected by the presence of version rows under AgentVersionService#GLOBAL_OWNER. The control plane materializes those rows at startup (ManagedAgentsMigrationRunner → AgentCatalogService#ensureGlobalVersions), so any agent the data plane can be asked to run already has one — sessions are created by the control plane before traffic reaches here.

• Own agents resolve from the caller's UserAgentDefinitionStore namespace.

• Shared-in agents resolve by scanning other owners' namespaces and admitting the first entry on which AgentAclService#tierFor grants any tier (USER or WORKSPACE grantee).

Tier enforcement itself stays in AgentAccessGuard; this class only decides visibility and returns the definition.