TOOLS-37: bridge canonical and legacy client provisioning

[averycrespi]

Context

Migrate the agent-tools provisioning producer without breaking existing Pi clients. This is a dual-export transition, not canonical-only cutover.

Changes

• Add configure-agent-gateway.sh, canonical transfer-path support and one canonical managed shell block. Retain the old standalone entry point because sb provision copies each script individually.
• Derive both endpoint/token pairs from one trusted endpoint and one current validated agent-token file. Reject unsafe parent paths, malformed/duplicate markers, invalid or conflicting credentials; never overwrite or delete credentials.
• Document private transfer preflight, old/new mappings, consumer matrix, fresh-shell/Pi restart, rollback and nonsecret adoption evidence.
• Add isolated provisioning regressions and fix three separately authorized baseline E2E lint findings without changing production behavior.

Review Notes

Independent review and focused repair confirmation found no remaining material findings at the pre-publication boundary. The unsafe empty-parent fallback was reproduced and repaired.

Producer-first rollout: this compatibility PR can ship before agent-config migrates. Delivered agent-config fadc9ac8d681f27bf9c8e5f59fc56011a0d512b1 accepts the retained legacy variables; its real loader was qualified with the old producer and both transition entry points using synthetic isolated material. Canonical-consumer integration is deferred until that consumer is delivered and remains required before canonical-only provisioning or alias retirement—not before this dual-export PR. No external repository edits, credential operations, live rollout, native-keyring qualification or release acceptance are claimed. CI is not proof of rollout.

Test Plan

Passed locally on Linux:

• make -C agent-gateway verify (memory-limited Go scheduling; no checks suppressed).
• make fmt-check and repository pre-commit formatting/lint. A killed mcp-broker lint process was rerun independently and passed.
• go -C agent-gateway tool golangci-lint run --build-tags=e2e ./test/e2e: full scan, zero issues.
• make -C agent-gateway test-e2e: full count-one race-enabled owner after shared-fixture repairs. After the isolated directory-preflight repair, reused unchanged fixture evidence and reran all current TestProvisionGateway* tests with -race -tags=e2e -count=1.
• Both scripts: bash -n; git diff --check.
• Pinned external consumer: five upstream configuration tests plus old producer, transition canonical entry and transition legacy entry through the real loader; pairing, administrator rejection, redaction and project/global authority covered.
• Gitleaks staged/history and exact PR metadata scans.

All 11 required checks, including Required, passed at 3853aca711aecf5d15b646134178193f9c46135f in CI run 34775956426, attempt 1; fresh authoritative reads confirmed the complete set. New-consumer integration remains not run and belongs to the subsequent consumer/canonical-only rollout, not this compatibility producer's readiness gate.