feat(multiplayer): deliver signed workload tokens via Agones allocation annotation

Closes the remaining gap the previous two commits left open: WorkloadVerify
itself worked, but nothing minted a real token at allocation time or handed
it to a running pod, so it had no real caller yet.

agones.Client gains WorkloadSecret/WorkloadTokenTTL. When set, Allocate
mints a signed workload token for the allocation (allocation_id is known at
request-construction time, before Agones has picked a server -- see the
previous commit for why that's the only identifier the token can bind) and
requests it as a third cosmic-clash.io/workload-token annotation, alongside
the existing match-id/allocation-id ones. Left unset (the default), Allocate
requests no such annotation, so a deployment not yet using this path is
unaffected. cmd/allocator wires it from a new --workload-secret /
COSMIC_CLASH_WORKLOAD_SECRET flag (must match cmd/control-plane's own), with
a startup warning if left unset.

supervisor.Supervisor.workloadToken() resolves the bearer credential for
control-plane registration: an explicitly configured --workload-token-path
always wins (kept for a future Kubernetes-projected-JWT WorkloadVerify path,
not yet wired server-side), otherwise it falls back to the
cosmic-clash.io/workload-token annotation on the allocated GameServer --
the same annotation-fallback pattern matchID already used for
cosmic-clash.io/match-id. WorkloadTokenPath is accordingly no longer
required at construction time when ControlPlaneURL is set.

Verified: new agones test proves the annotation is requested (and parses/
verifies against the same secret, naming the right allocation) when
WorkloadSecret is configured, and that it's absent when it isn't; new
supervisor tests prove the annotation-sourced token is what's actually sent
as the Authorization bearer, and that Start fails closed with neither a
configured path nor an annotation present. Full
`go build ./... && go vet ./... && gofmt -l . && go test ./... -race` and
`go test -tags integration ./... -race` both clean.

server/agones/allocation.go

@@ -16,12 +16,30 @@ import (
 	"time"
 
 	"github.com/cosmic-clash/cosmic-clash/server/domain"
+	"github.com/cosmic-clash/cosmic-clash/server/workload"
 )
 
 type Client struct {
 	BaseURL   string
 	Namespace string
 	HTTP      *http.Client
+
+	// WorkloadSecret, when set, mints a control-plane-self-issued signed
+	// workload token (server/workload/signed_token.go) for every allocation
+	// and requests it as the cosmic-clash.io/workload-token annotation
+	// alongside match-id/allocation-id -- the delivery channel
+	// supervisor.Supervisor.workloadToken() reads from. It must be the same
+	// secret cmd/control-plane verifies with (--workload-secret /
+	// COSMIC_CLASH_WORKLOAD_SECRET). Left unset, Allocate behaves exactly as
+	// before: no workload-token annotation is requested, matching how a
+	// deployment not yet using this delivery path (e.g. one still building
+	// toward a Kubernetes-JWT WorkloadVerify) is unaffected.
+	WorkloadSecret []byte
+	// WorkloadTokenTTL bounds how long the minted token remains valid; it
+	// must comfortably exceed the time between allocation and this
+	// GameServer completing process-ready/assignment-ready registration.
+	// Zero defaults to 30 minutes.
+	WorkloadTokenTTL time.Duration
 }
 
 type AllocatedServer struct {
@@ -155,6 +173,17 @@ func (c Client) Allocate(ctx context.Context, request domain.AllocationRequest,
 		"cosmic-clash.io/match-id":      request.MatchID,
 		"cosmic-clash.io/allocation-id": request.AllocationID,
 	}
+	if len(c.WorkloadSecret) > 0 {
+		ttl := c.WorkloadTokenTTL
+		if ttl <= 0 {
+			ttl = 30 * time.Minute
+		}
+		token, err := workload.IssueSignedWorkloadToken(c.WorkloadSecret, request.AllocationID, now, ttl)
+		if err != nil {
+			return AllocatedServer{}, fmt.Errorf("issue workload token: %w", err)
+		}
+		body.Spec.Metadata.Annotations["cosmic-clash.io/workload-token"] = token
+	}
 	encoded, err := json.Marshal(body)
 	if err != nil {
 		return AllocatedServer{}, err