fix(training-agent): drop noopJwksValidator production guard

[bokelley]

Summary

Hotfix #2 after the multi-tenant migration. After #3854 fixed the registry-init crash (postgres task registry), production smoke still failed:

POST /signals/mcp → HTTP 404
{"jsonrpc":"2.0","id":null,"error":{"code":-32000,"message":"Tenant 'signals' is not registered"}}

Cause

A NODE_ENV=production-gated guard in noopJwksValidator (added in the round-1 review fixes for #3713) threw at validation time. The SDK caught the throw, marked every tenant disabled, and resolveByRequest returned null for every lookup.

Fix

Remove the guard. It was overprotective: reviewers added it on the theory that an adopter might accidentally import the no-op into a production registry that should be enforcing JWKS validation — but the only consumer of this file is the training agent's production deployment, which uses the no-op by design (brand.json is mounted at /api/training-agent/.well-known/brand.json, not host root, so the SDK's default validator can't reach it).

The guard fired in production and broke the deployment it was meant to protect.

After deploy

Smoke that should now return 200:

curl -s -X POST https://test-agent.adcontextprotocol.org/signals/mcp \
  -H "Authorization: Bearer 1v8tAhASaUYYp4odoQ1PnMpdqNaMiTrCRqYo9OJp6IQ" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Test plan

• TypeScript clean
• 382/382 tests passing
• After deploy: per-tenant POST returns 200 with the right tools

🤖 Generated with Claude Code