feat(rooms): roomctl client, oauth2-proxy bearer tokens, AP-6 pins (SP2 phase 6)

[Smana]

SP2 phase 6, S6: roomctl's ZITADEL client, oauth2-proxy bearer tokens, and AP-6's pins (agent-platform#28). Stacked on S5 (#2205); stays open until the phase 7 merge wave (P33). Task 6.4 ([LIVE]: SC-7, roomctl end to end, SC-13, /verify-spec) runs on a cluster after this.

sequenceDiagram
  autonumber
  actor D as Developer
  participant R as roomctl
  participant Z as ZITADEL
  participant P as rooms oauth2-proxy
  participant B as room-broker
  D->>R: roomctl login
  R->>Z: device authorization (client roomctl, no secret,<br/>scope ...project:id:P:aud offline_access)
  Z-->>D: verification URL + code
  D->>Z: sign in, approve
  R->>Z: poll token endpoint
  Z-->>R: JWT access token (+ refresh)
  R->>P: GET /v1/ws, Authorization: Bearer JWT
  Note over P: skip-jwt-bearer-tokens,<br/>extra issuer = roomctl client id, allowed groups
  P->>B: the same JWT as bearer and access token
  Note over B: client_id = roomctl, so webUI=false:<br/>read, chat, queue, fork only (ruling P18)

Loading

Change	Why
zitadel-oidc-clients.sh: consumer roomctl, type native (app NATIVE, auth NONE, grants device code + refresh token, JWT access tokens) → store key agents-roomctl → OpenBao agents/roomctl {client-id}	ADR-0049's native client. A native app gets no secret back: the create path no longer fails for it, and an existing native app whose key is missing gets its id written again (nothing was lost)
bao-map.sh: agents-roomctl → agents/roomctl	The mirror's one map
externalsecret-roomctl.yaml: room-broker-roomctl (the broker's file) and rooms-proxy-extra-issuers (<issuer>=<client id>)	Ids from the store, never literals: gcp-0 mints new ones every build
oauth2-proxy.yaml: skip-jwt-bearer-tokens: "true", OAUTH2_PROXY_EXTRA_JWT_ISSUERS from that Secret	roomctl's bearer tokens pass, checked against their own client
app.yaml + config.yaml: /etc/room-broker/roomctl/client-id (optional mount), roomctlClientIDFile	The broker tells roomctl's tokens from the web UI's
Pins: broker + retention CronJob → AP-6's pre-release by digest; crd-rooms.yaml header and atlasSchema.ref → feat/room-fork-roomctl	P33: one image, one version. The CRD and the migrations are unchanged in AP-6
test-zitadel-oidc-clients-rooms.sh: §9 (roomctl), and the harness loads stored_client_id and stubs restart_rotated_consumers	§7 had failed since #2149 reached this stack (stored_client_id: command not found, exit 127); no PR check runs on a stacked PR, so nobody saw it
User guide: "Follow and feed a room from a terminal"	The commands, and what roomctl never does
test-zitadel-oidc-clients-rooms.sh loads previous_client_id and stubs mirror_read	After merging main, #2208's previous_client_id in cmd_sync made every §7/§9 case exit 127 (5 FAIL, expected 0 got 127)

No ADR: ADR-0049 already chose roomctl with its own native ZITADEL client; the device flow is how a native CLI signs in without a redirect to the laptop or a secret to leak.

Order on a live cluster: run the sync first (it creates the client and mirrors agents/roomctl), then flux reconcile hr rooms-oauth2-proxy -n agent-system --force. Until the Secret exists, the new oauth2-proxy pod waits for it and the old one keeps serving; after three failed upgrades Helm rolls back to skip-jwt-bearer-tokens: "false" and the release stalls, and nothing retries it once the Secret appears (review I2: the same note sits on the env var in oauth2-proxy.yaml, and in Task 6.4's new Step 0). The broker's mount is optional. Review M8, the factory's API accepting roomctl's tokens: already wired on feat/factory-runlore (agent-factory-oidc ExternalSecret from agents/roomctl, api.clientIDFiles), so the factory too waits for this sync.

Follow-up (review M7): restart_rotated_consumers matches only openbao-* stores and clustersecretstore, not agents-secrets: when roomctl's client id rotates, rooms-oauth2-proxy keeps a stale EXTRA_JWT_ISSUERS until restarted (rooms-proxy has the same gap; the broker re-reads its file).

Pins: ghcr.io/smana/room-broker:v0.0.1-pr28.91a6fb39@sha256:2889162f2dcbacb637769c6b3f7653e9a689a61e8bb5a39224a08a105cbfe884 (app and retention CronJob: AP-6 with its review fixes and the owner's fork rulings M2/M3); crd-rooms.yaml from feat/room-fork-roomctl at 91a6fb3 (identical content); atlasSchema.ref: feat/room-fork-roomctl. The room-bridge pre-release (…@sha256:066b21e7d80d3f670f0465bcdcdc6967e2ae212f8e90dd9b5bc39e003b9235f4) is pinned in crossplane-configuration, not here.

Evidence (head 764cfd5)

Gate	Result
validate-manifests.sh (XRD CRDs from fetch-xrd-crds.sh)	exit 0, Valid 2743, Invalid 0, all gates passed
scripts/ci/tests/run.sh	exit 0: 56 passed, 1 skipped (vector not installed), 0 failed
test-zitadel-oidc-clients-rooms.sh	RED first (FAIL native: app type), then all checks passed; after the main merge RED (expected 0 got 127), then all checks passed
validate-links.sh, validate-doc-claims.sh, validate-idp-topology.sh, validate-openbao-policies.sh, verify-doc-paths.sh	exit 0 each