Function provision_agent_client 

async fn provision_agent_client(
    agent_id: &str,
    mstore: &Arc<Store>,
    http: &Client,
    base: &str,
    user_token: impl Future<Output = Result<String, String>>,
) -> Result<(), CredentialFailure>

Calls POST /agents/provision (authenticated with the human’s own PKCE token — an M2M agent credential can never provision another one) and caches the returned client_id/client_secret.