fix(api): retire Kong key-auth on model routes; agent-pod builds agent-manager fork + ships coordinator.js

Kong key-auth rejected the Authorization: Bearer header every OpenAI-SDK-compatible client sends (verified: raw apikey header works, Bearer doesn't), so it's commented out and stripped from every llm-routes.yaml annotation until there's a Bearer-compatible fix. agent-pod now clones and builds the agent-manager fork from source at container start (no prebuilt binary shipped -- wrong arch and over ConfigMap's size cap) and ships coordinator.js alongside hub.js, so multiple repos can run the pipeline concurrently in one pod via kubectl exec. hub.js keeps its existing role as the container's foreground process, unchanged.

k8s/apps/agent-pod/deployment.yaml

@@ -27,6 +27,26 @@ spec:
         # container can't exec into another container's filesystem/PATH.
         # It IS the container's long-running process now; no more `sleep
         # infinity` placeholder.
+        #
+        # Also builds the agent-manager fork (github.com/Riotpiaole/
+        # agent-manager, add-headless-spawn branch) from source and drops
+        # coordinator.js in beside hub.js -- neither is the container's
+        # foreground process. hub.js keeps that role unchanged; running
+        # multiple repos' pipelines concurrently in this one pod means
+        # `kubectl exec <pod> -- node /root/coordinator.js --repo X --tasks
+        # Y &` once per repo, each an independent process inside the same
+        # container, each spawning its own agent-manager-tracked sessions
+        # on the container's local tmux server -- `kubectl exec -it <pod>
+        # -- agent-manager` attaches its TUI live against those same
+        # sessions, no cross-machine visibility problem since spawner,
+        # tmux server, and viewer are all colocated here.
+        #
+        # No prebuilt Linux binary is shipped for agent-manager: the local
+        # .bin/ build is macOS arm64 (wrong OS/arch for this container
+        # anyway) and it's 27MB, well over a ConfigMap's ~1MiB cap. Debian's
+        # `apt-get golang-go` is far too old for this fork's go 1.26.5
+        # requirement, so the real Go toolchain is fetched directly from
+        # go.dev instead.
         - name: pi
           image: node:22-slim
           command:
@@ -40,10 +60,21 @@ spec:
               ssh-add /root/.ssh/id_forgejo
               npm install -g @earendil-works/[email protected]
               npm install --prefix /root ws
+
+              curl -fsSL "https://go.dev/dl/go1.26.5.linux-$(dpkg --print-architecture).tar.gz" | tar -C /usr/local -xz
+              export PATH="$PATH:/usr/local/go/bin"
+              git clone --branch add-headless-spawn --depth 1 \
+                https://github.com/Riotpiaole/agent-manager.git /root/agent-manager-src
+              (cd /root/agent-manager-src && go build -o /usr/local/bin/agent-manager .)
+
               node /root/hub.js
           env:
             - name: PI_BIN
               value: pi
+            - name: AGENT_MANAGER_BIN
+              value: /usr/local/bin/agent-manager
+            - name: HUB_WORK_DIR
+              value: /root/agent-harness-work
           ports:
             - containerPort: 9090
           resources:
@@ -65,6 +96,9 @@ spec:
             - name: hub-src
               mountPath: /root/hub.js
               subPath: hub.js
+            - name: coordinator-src
+              mountPath: /root/coordinator.js
+              subPath: coordinator.js
             - name: ssh-key
               mountPath: /root/.ssh/id_forgejo
               subPath: id_forgejo
@@ -99,6 +133,9 @@ spec:
         - name: hub-src
           configMap:
             name: hub-src
+        - name: coordinator-src
+          configMap:
+            name: coordinator-src
         - name: ssh-key
           secret:
             secretName: agent-pod-ssh-key