feat(auth): authenticate Substrate actor calls to the control plane

[EItanya]

Actors now authenticate to the controller with Substrate-issued JWTs in the standard Authorization header. A separate runtime listener (:8084 by default) requires Actor JWTs and allows only TaskStore and Memory. The user listener keeps its configured authentication mode and rejects Actor JWTs as user credentials.

TaskStore checks the session, atespace, and current Actor UID. Memory derives its agent and user scope from the same persisted binding, so request fields and forwarded headers cannot select another identity's memory. Actors do not inherit their session owner's general API permissions.

Substrate egress replaces a placeholder with a five-minute JWT for the kagent-runtime audience. The controller verifies it through Substrate OIDC discovery/JWKS using the existing JWT dependencies. This works with the pinned Substrate v0.6.0-alpha3. config.substrate.actorJwtIssuer defaults to https://idp.ate-system.svc.

Controller and runtime images must upgrade together; older runtime snapshots must be recreated. Memory now uses the stored namespace/name agent reference as its key; existing entries keyed by runtime display names are not migrated.

Validated real JWT injection, credential rejection, and checkpoint/fork restoration on kagent, Codex, Claude, and BYO ADK. Go and Python tests, gRPC/PostgreSQL integration tests, 52 Helm checks, protobuf checks, and Go lint pass.