Record the service SVID authentication decision in the Go plan - #16353

The Agentplane organization plan still said no service authentication mechanism was selected. The operator chose one on 2026-11-14: "One auth mode can fire off", PRIVILEGED_BACKEND_AUTH_DESIGN option 2. Its decision record is in #16342. This brings the plan in line.

What changes

• privileged-auth now reads "Replace backend bearers with service SVIDs without moving the auth owners". It is PLANNED, where it was DEFERRED DESIGN.
  • Every first-party service call authenticates its caller with a service SVID over mTLS.
  • Bearer admission, Agentplane's TokenReview, projected token audiences and the tokenreviews RBAC go.
  • The app's agentplane-agent bearer goes separately.
  • The migration removes code paths inside files and moves none: net/peertls and identity/auth stay the owners. Its stages belong to the DAG node, with the receiver step in Add exact service SVID admission and certificate-backed delegation #16350.
  • No reorg move waits on it.
• Stage 6 is now "Service authentication migration and deferred protobuf contracts". Protobuf namespaces stay deferred.
• Runtime proxy grant. The proxy's mutating methods go to the Sessions binary's service SVID, in both the runner-gateway-connections-proxy track and the "Runtime calls" cut-line card. Before, it said "workload identity".
• net/peertls package gate. The SVID migration now extends the package in place.
• Evidence and README. evidence.json records the operator's words, and the report README's stage and status text matches.

Deliberately left out

• No file dispositions change. TokenReview code sits inside files that otherwise stay; the migration's own PRs remove it.
• No ledger re-pin. No Agentplane source changed since 02dc3c7a2e.

Checks

• Structural check against the 02dc3c7a2e inventory: PASS (42 tracks, 1,270 files, 222 packages).
• prettier@3.9.10 --check: clean.
• Local Playwright: the home page and the report render at desktop and mobile, in light and dark, with no horizontal overflow and no console errors.
• No source behaviour tests run; this is a planning-only change.

Generated by Claude Code