Register/replace/clear the AGNTA counterparty allow-set for the caller's opted-in DelegationGrant (non-custodial control plane).

Persists to Django so the set survives an MCP process restart and is visible to every process -- the durable successor to the earlier process-local InMemoryCounterpartySetResolver. wallet_address must belong to an AgentWallet with a non-blank agnta_grant_pda already configured (opting in is a separate step, out of scope here); the target grant_pda is always resolved from that wallet, never caller-supplied. members is a list of base58 32-byte destination pubkeys the grant's counterparty_root should allow -- pass an EMPTY list to CLEAR the registered set, after which every transfer-class call naming an on-chain destination for this grant fails closed.

expected_root (hex, optional but STRONGLY recommended): compare against the grant's live on-chain counterparty_root (hex-encoded) before calling this -- when given, a set that does not commit to it is refused (INVALID_PARAMS) rather than silently registered, which would otherwise surface later as a confusing AGNTA_GRANT_COUNTERPARTY_DENIED on an unrelated transfer.