Capture RFC 8693 act claim in audit logs

[JAORMX]

Summary

The embedded authorization server already mints delegated JWTs with the RFC 8693 act claim and supports nested act for multi-level delegation (pkg/authserver/server/tokenexchange/handler.go). However, when those tokens are presented to the proxy / vMCP request-serving path, audit events only recorded the terminal sub (the original user). It was impossible to distinguish "Alice did X" from "Alice's coding agent did X on Alice's behalf" — the exact forensic gap RFC 8693 is designed to close.

This change captures the full delegation chain in every audit event for requests authorized by a delegated token:

• Adds auth.DelegationChain / auth.ParseDelegationChain to parse nested act claims with a bounded depth (default 10, aligned with the token-exchange issuance cap) and explicit truncation reporting (dropped_count).
• Promotes the parsed chain into auth.Identity / auth.PrincipalInfo during claimsToIdentity so downstream consumers see it as a structured field rather than an opaque JWT claim.
• Extends audit.AuditEvent with a delegationChain member and teaches both the HTTP Auditor and WorkflowAuditor to populate it from the request identity, respecting the configured maxDelegationDepth.
• Covers issuance → validation → audit extraction with unit tests, middleware-level tests (including SSE stream opens), and an end-to-end integration test that mints a delegated token via the real token-exchange handler and asserts the audit event.

Closes #6035

Type of change

• New feature

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

Changes

File	Change
pkg/auth/delegation.go	New DelegationChain, DelegatedActor, ParseDelegationChain, DefaultMaxDelegationDepth
pkg/auth/identity.go	Add DelegationChain *DelegationChain to PrincipalInfo and MarshalJSON
pkg/auth/context.go	Parse act claim into identity during claimsToIdentity
pkg/audit/event.go	Add DelegationChain field and WithDelegationChain builder; emit in LogTo
pkg/audit/config.go	Add MaxDelegationDepth *int and MaxDelegationDepthOrDefault()
pkg/audit/auditor.go	Extract and attach delegation chain in logAuditEvent and logSSEConnectionEvent
pkg/audit/workflow_auditor.go	Attach delegation chain in all workflow/step audit methods
pkg/authserver/integration_test.go	End-to-end test: mint delegated token, run through audit+auth middleware, assert chain
pkg/audit/auditor_test.go	Unit tests for extraction, depth cap, SSE path
pkg/audit/workflow_auditor_test.go	Unit tests for workflow delegation chain
pkg/auth/*_test.go	Tests for parsing, identity population, JSON marshaling
docs/middleware.md	Document delegation_chain audit field
docs/arch/02-core-concepts.md	Add delegation chain to audit event field list
docs/server/*	Regenerated swagger/CRD docs

Does this introduce a user-facing change?

Yes. Audit events for requests authorized by delegated tokens now include a delegation_chain field that lists the acting parties (outermost first) and a truncated / dropped_count indicator when the chain exceeds the configured depth cap. The maxDelegationDepth audit config knob (default 10) is now available.

Implementation plan

Approved implementation plan

1. Add shared DelegationChain / ParseDelegationChain type in pkg/auth.
2. Promote act into Identity / PrincipalInfo during claimsToIdentity.
3. Extend AuditEvent with delegationChain while keeping Subjects backward compatible.
4. Populate in both HTTP and workflow auditors with configurable depth cap.
5. Add unit, middleware, SSE, and integration tests.
6. Update operator-facing docs and regenerate swagger/CRD docs.

Special notes for reviewers

• The depth cap (10) is intentionally aligned with maxDelegationDepth in pkg/authserver/server/tokenexchange/handler.go:31 and maxClaimNestingDepth in pkg/authz/authorizers/cedar/entity.go:18.
• The integration test proves the middleware chain alone publishes the identity to the audit holder; the stub handler does not re-publish.
• SetLogWriterForTest is marked deprecated in favor of a future NewAuditorWithWriter constructor.

[codecov]

Codecov Report

❌ Patch coverage is 98.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.32%. Comparing base (33023da) to head (7d0d474).
⚠️ Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/audit/auditor.go	94.44%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6046      +/-   ##
==========================================
+ Coverage   72.26%   72.32%   +0.06%     
==========================================
  Files         722      725       +3     
  Lines       75138    75443     +305     
==========================================
+ Hits        54296    54567     +271     
  Misses      16980    16980              
- Partials     3862     3896      +34     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.