test(e2e): git and gh as the person on the kagent Harness #292

Problem

The Claude harness's path to git as the person has contract tests, and the Session pieces each prove their own step (#293 to #299). Nothing proves the whole path on the kagent Harness end to end: a Declarative agent in a Session of a workspace, working in its own session directory, that fetches, commits and pushes a private repository and calls the provider's API as the person through the bash tool, with no token in the sandbox, the commit attributed to the person, and a clear refusal for a caller who has not signed in. Model: agent-workspace-management (W3, W4, W7; merged in bumblebee-plans#119).

Proposed solution

One fork e2e test in go/core/test/e2e, on the workspace fixtures of #293 and the Session's actor-JWT caller credential of #297 (#481):

• The workspace is one read-write-many volume with a bare mirror of each fixture repository (mirrors/<owner>/<repository>.git); the Session gets its own session directory on it (sessions/<session>/, read-write, the Harness's working directory) and the mirrors read-only, with clones borrowing the mirrors' objects. No snapshots.
• A Declarative agent on the kagent Harness without skills; a Session admitted with a grant naming the fixture repositories and a Bearer provider for the mock origin's API host; turns that run git fetch, git commit, git push and gh api user through the bash tool.
• The test asserts the origin's recorded Authorization headers on the provider's host carry the Actor's JWT bound to the provider's audience and never the placeholder; env, the session directory and /data hold no token (the placeholder only); the pushed commit is authored by the caller; a Session of the same agent without a grant sends no credential and gets the gateway's 403 on the host; the caller the grant refuses gets the gateway's message in the tool result.
• A Basic git host gets no credential until Substrate's token exchange (agent-substrate/substrate#1661); the test's push and fetch over it join then.

Acceptance criteria

• TestGitAsThePersonKagentHarness passes in ci.yaml's e2e job on every pull request: the provider's API call arrives with the Actor's JWT for its audience; env, the session directory and /data hold no token; the commit's author is the caller; the refused caller's push and gh call fail with the gateway's message in the tool result
• A Session without a grant on the same Harness: the origin records no credential and the sandbox gets the gateway's 403
• The Session's directory is its own: it cannot write the mirrors or another Session's directory
• The test runs on the claude Harness too, skipping only the steps that Harness's own suite covers (both Harnesses in the test matrix)