agent-provision creates consumers that cannot mint tokens (grant_types and user_id never set)

Problem/Motivation

drush mcp-sentinel:agent-provision --env= creates/updates the consumer with client_id, label, owner_id, status, and scopes — but never sets grant_types or user_id (simple_oauth's default user for the client). The result is a principal that satisfies the readiness contract (owner active, role bound, designated) yet cannot authenticate at all: every token request fails with unsupported_grant_type, and after grant_types is hand-fixed, the token endpoint 500s with "Invalid default user for client".

Observed live during a per-environment consumer migration: both provisioned consumers were readiness-sound but could not mint a single token. Readiness walks owner/role/designation but not token-mintability, so the gap stays invisible until the first real token request — a silent-until-used failure on the provisioning path.

Proposed resolution

1. Set grant_types to client_credentials on create (and ensure on update).
2. Set user_id to the tier account (the same account owner_id points at).
3. Kernel coverage that a provisioned consumer passes ClientRepository validation for the client_credentials grant; consider surfacing both fields in the provision summary table.

Mirror with full incident detail: https://github.com/Wilkes-Liberty/mcp_sentinel/issues/126