Admit service certificates and typed MCP actors at Actions - #16354

…16358)

Add exact service SVID allowlists for LLM ModelConfig reads and Central
Sampler inference delegation. The sampler must supply a typed effective
Identity and Session envelope; live UID verification and the Identity’s
egress grants remain authoritative. A service certificate carries
neither a synthetic account nor Pod proof, and failed certificate
verification cannot select a bearer fallback.

Rebased PR head: `958c9417080866e425fa72e8195c479f0f4f28c3`. This PR
targets devel because cross-fork native stacks are unsupported.

Stage 3 only. Deliberately excludes production settings, the sampler’s
`auth.mode: agentplane_ingress` caller switch, other caller TLS changes,
and TokenReview/RBAC removal. Those wait for receiver image pins.
Staging’s existing bearer mode continues during this stage. The overview
includes optional service edges.

Validation: pre-commit and commit hooks passed. Isolated `bbr test
//agentplane/llm_ingress:ingress_test //agentplane/llm_ingress:settings`
passed (real TLS peer/delegation tests, exact caller denial, effective
Identity/Session, stale UID and bearer ambiguity). Deployment suite
coverage is recorded below.

Rollback: revert before enabling service callers; after caller
migration, first restore compatible caller images/settings. Existing
bearer/workload admission remains available at this stage. Check
ModelConfig discovery and ordinary inference after rollout.

Isolated `bbr test //agentplane/llm_ingress:ingress_test
//agentplane/llm_ingress:settings` passed
(https://app.buildbuddy.io/invocation/ff86e46a-7863-4843-a78a-19815e3c2aa1).
Deployment suite `bbr test
//agentplane/system_tests/suites/mcp:test_services` passed
(https://app.buildbuddy.io/invocation/16dc4905-93cc-4c45-bc49-9fb33e486584).

Rollout gate: no new certificate-path or service-allowlist manifest
setting until #16359 merges and the receiver images are pinned.

Inactive service defaults are omitted from rendered settings. `bbr test
//agentplane/llm_ingress:settings
//cluster/cdk8s:test_generate_manifests` passed
(https://app.buildbuddy.io/invocation/19584d67-2eb9-41cc-9e33-fbfdb3960e32).

## Questions for Claude

Before stage 4, verify staging central Sessions retain execution
Identity name and UID required by typed LLM delegation. No fallback to
bearer is permitted if that proof is absent.

Rebased after #16354 and #16357 merged; the only conflict was in
`system_overview.md`. Both merged diagrams and the LLM authentication
edge are preserved. Scoped pre-commit and `git diff --check` passed;
receiver code is unchanged by this rebase.

---------

Co-authored-by: agentydragon-agent <260791330+agentydragon-agent@users.noreply.github.com>