docs(agents): ephemeral-realm SIP credential test call workflow

[michaela-band]

Summary

• Adds a ### Test SIP credentials end-to-end workflow to AGENTS.md documenting how an agent can verify SIP auth by placing a real call through Bandwidth
• Uses an ephemeral realm + fresh credential so nothing existing is disrupted; both are torn down after the call
• Captures the generated password once from credential create --plain, writes it to a chmod 600 temp file, and immediately unsets it from the environment — the password never touches a log or command line
• Includes a signal-to-meaning table for common SIP responses (407 → re-INVITE, 200 OK, 403, 503) so an agent can interpret what happened without guessing
• Notes the band number list limitation on Bandwidth Build accounts and the DNS propagation delay on newly-created realms

Why no band sip call command

The implementation would require invoking baresip (or another SIP UA) as a subprocess and managing a temp config file from Go. That's external tool coupling, subprocess management, and platform-specific behavior that doesn't fit the CLI's model — it's a pure API client. The AGENTS.md workflow documents the same recipe in a way that works with any SIP UA and doesn't add a fragile dependency to the binary.

Test plan

• Read through the workflow in AGENTS.md and verify the shell commands are correct E2E (realm create → credential create → jq extract → temp file → baresip dial → cleanup)
• Confirm the band number list Build caveat matches the existing note in the Build Registration section
• Confirm PR is against feat/sip-provisioning, not main

🤖 Generated with Claude Code

[bwappsec]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.