Type operator_handle on the assess response

/v1/assess now returns a stable pairwise handle for the account behind a
presented operator token. Typed here so SDK consumers keying durable state on
identity (prepaid balances first) can read it without casting.

Author: vvillait88

agentscore/types.py

@@ -337,6 +337,18 @@ class AssessResponse(_AssessResponseRequired, total=False):
     # responses; omitted on denials to avoid leaking the linked set for flagged operators.
     # Capped at 100 entries.
     linked_wallets: list[str]
+    # Stable pairwise handle (``oph_...``) for the ACCOUNT behind a presented operator
+    # token. This is the identity durable merchant state should key on, because it survives
+    # the token rotating, expiring or being revoked: an ``opc_`` lives 24h and rotates
+    # silently off a 90-day refresh, so anything keyed on the token instance is stranded
+    # daily. Pairwise per consuming account, so the same buyer presents an unrelated handle
+    # to every merchant and handles never correlate across them.
+    #
+    # Carries no compliance meaning: a registration-only (``sign_in``) credential resolves
+    # the same as a KYC-backed one, so read the decision fields for policy. Present only on
+    # the operator-token path, and returned on denials too, since it is identity rather
+    # than a verdict.
+    operator_handle: NotRequired[str]
     verify_url: str
     policy_result: PolicyResult | None
     explanation: NotRequired[list[PolicyExplanation]]