feat(cmd): forge auth subcommand for runtime-token operator UX (#162 part 1)

[initializ-mk]

Summary

First of a 3-PR stack closing #162. Adds three operator-facing primitives for the internal bearer token Forge mints at agent startup — the same token channel adapters use to call back into A2A (`runner.go:201-225`):

```
forge auth show-token Print the stored token to stdout.
Exits 1 with an actionable error pointing
at 'forge auth mint-token' when absent.

forge auth mint-token Generate a fresh 256-bit token, store it
at /.forge/runtime.token (0600),
print to stdout. For first-deploy bootstrap
from a clean checkout.

forge auth secret-yaml Print a ready-to-apply Kubernetes Secret
manifest with the token base64-encoded
into data.token. Default name and
namespace match what 'forge package' will
generate in part 3 of the issue.
```

The 3-PR stack

Part	Scope	PR
1 (this)	`forge auth` subcommand — operator UX primitives, prerequisite for parts 2+3	this PR
2	`ScheduleBackend` interface + `FileBackend` (existing refactor) + `KubernetesBackend` (real client-go) + runtime auto-detection	next
3	`forge package` generates CronJob / Secret-template / Role manifests	last

This PR is independently shippable — operators get the token primitives today even without K8s scheduler.

Design choices

Secret-template parity with `forge package` — `forge package` (part 3) will emit a credential-less Secret template; `forge auth secret-yaml` is the one-liner that populates it. The two outputs are byte-identical except `forge package`'s template has no `data` field. Operator workflow:

```sh

In CI / from a clean checkout:

forge package # generates k8s/internal-token-secret.yaml (no data)
forge auth secret-yaml | kubectl apply -f - # populates the data field
kubectl apply -k ./k8s # applies everything else
```

`forge.agent.id` label always tracks forge.yaml, never `--name`. An operator using `--name` to clobber the Secret resource name still wants telemetry and label-selectors keyed on the real agent ID. Regression test (`TestAuthSecretYAMLOutput_LabelTracksForgeYAML`) pins this — caught during PR bring-up smoke.

```
$ echo "agent_id: aibuilderdemo" > forge.yaml
$ forge auth mint-token > /dev/null
$ forge auth secret-yaml --name custom-secret --namespace prod
apiVersion: v1
kind: Secret
metadata:
name: custom-secret # ← from --name
namespace: prod # ← from --namespace
labels:
forge.agent.id: aibuilderdemo # ← from forge.yaml, NOT --name
type: Opaque
data:
token: VUxEU0UwUGpETXRYMGlvSUpnbXZmSzF5YW5TbTBMbDM2X1c0RjhHWTlJbw==
```

Light-touch forge.yaml parse for `agent_id` rather than pulling the full `ForgeConfig` validation chain. The command runs outside the runtime, often in CI / bootstrap contexts where a validation error on an unrelated field would be a footgun. Falls back to `"forge-agent"` when the file is missing or `agent_id` is empty.

Files

File	Change
`forge-cli/cmd/auth.go` (new)	`forge auth` cobra command + three subcommands; `agentRootDir` helper resolving from `--output-dir`; `agentIDForSecretName` light-parse helper
`forge-cli/cmd/auth_test.go` (new)	6 tests covering parse cases, label-tracking invariant, token round-trip with 0600 perms
`forge-cli/cmd/root.go`	Register `authCmd`

Test plan

• `go test ./...` clean in forge-core and forge-cli
• `golangci-lint run ./...` → 0 issues
• `gofmt -w` applied
• All 6 new tests pass
• End-to-end smoke against `/tmp/forge-pr-auth`:
  • `auth show-token` from empty dir → exits 1 with clear error
  • `auth mint-token` → writes token, prints to stdout, exits 0
  • `auth show-token` after mint → prints same value
  • `auth secret-yaml` with default args → correct shape
  • `auth secret-yaml --name X --namespace Y` → name + namespace overridden, label unchanged

What's NOT in this PR (parts 2+3)

• No K8s client-go dependency added. `forge auth secret-yaml` is hand-rolled YAML (one `fmt.Printf`) so this PR has zero new dependencies.
• No scheduler backend interface. The existing 30s-ticker + `MemoryScheduleStore` is unchanged.
• No `forge package` manifest changes. CronJob / Secret-template generation lands in part 3.

Refs #162