Feature proposal/discussion: enable end-to-end Agent Access through PATs, answer-cli, and an Answer Skill

Is your feature request related to a problem? Please describe

There is no consistent, least-privilege way for CLI tools and coding agents to operate as an existing Answer user while preserving the user account permissions, moderation rules, CAPTCHA behavior, and the ability to revoke access.

Describe the solution you would like

Discuss an Agent Access design based on Personal Access Tokens, answer-cli, and an Answer Agent Skill.

The initial PAT scopes are:

• question.read
• question.create
• answer.read
• answer.create
• vote.write

This is an initial scope set and may be extended in future releases as additional workflows are defined.

The complete design, including authentication, authorization, token lifecycle, CLI behavior, Skill behavior, security considerations, and delivery phases, is documented in Agent Access Design.

This issue is intended for design review and discussion before implementation is expanded.

Related issue: #1555

Describe alternatives you have considered

• Continue using administrator-managed API keys, which do not represent an individual Answer user and are not suitable for least-privilege user delegation.
• Add agent-specific identities or a separate agent API, which would introduce new identity, attribution, and authorization models.
• Use unrestricted browser automation or ad hoc HTTP scripts, which would not provide a stable CLI contract or explicit revocation and scope controls.