feat(multiplayer): deliver signed workload tokens via Agones allocation annotation

Closes the remaining gap the previous two commits left open: WorkloadVerify
itself worked, but nothing minted a real token at allocation time or handed
it to a running pod, so it had no real caller yet.

agones.Client gains WorkloadSecret/WorkloadTokenTTL. When set, Allocate
mints a signed workload token for the allocation (allocation_id is known at
request-construction time, before Agones has picked a server -- see the
previous commit for why that's the only identifier the token can bind) and
requests it as a third cosmic-clash.io/workload-token annotation, alongside
the existing match-id/allocation-id ones. Left unset (the default), Allocate
requests no such annotation, so a deployment not yet using this path is
unaffected. cmd/allocator wires it from a new --workload-secret /
COSMIC_CLASH_WORKLOAD_SECRET flag (must match cmd/control-plane's own), with
a startup warning if left unset.

supervisor.Supervisor.workloadToken() resolves the bearer credential for
control-plane registration: an explicitly configured --workload-token-path
always wins (kept for a future Kubernetes-projected-JWT WorkloadVerify path,
not yet wired server-side), otherwise it falls back to the
cosmic-clash.io/workload-token annotation on the allocated GameServer --
the same annotation-fallback pattern matchID already used for
cosmic-clash.io/match-id. WorkloadTokenPath is accordingly no longer
required at construction time when ControlPlaneURL is set.

Verified: new agones test proves the annotation is requested (and parses/
verifies against the same secret, naming the right allocation) when
WorkloadSecret is configured, and that it's absent when it isn't; new
supervisor tests prove the annotation-sourced token is what's actually sent
as the Authorization bearer, and that Start fails closed with neither a
configured path nor an annotation present. Full
`go build ./... && go vet ./... && gofmt -l . && go test ./... -race` and
`go test -tags integration ./... -race` both clean.

server/agones/allocation_test.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/cosmic-clash/cosmic-clash/server/domain"
+	"github.com/cosmic-clash/cosmic-clash/server/workload"
 )
 
 func request() domain.AllocationRequest {
@@ -44,6 +45,56 @@ func TestAllocateBuildsStrictGameServerAllocationAndEndpoint(t *testing.T) {
 	}
 }
 
+// TestAllocateRequestsAWorkloadTokenAnnotationWhenConfigured proves the
+// delivery-channel wiring for the control-plane's self-issued signed token
+// (server/workload/signed_token.go): with WorkloadSecret set, Allocate
+// requests a cosmic-clash.io/workload-token annotation whose value actually
+// parses and verifies against that same secret and names this allocation's
+// ID -- the exact thing supervisor.Supervisor.workloadToken() reads back
+// and cmd/control-plane's WorkloadVerify checks. With WorkloadSecret unset
+// (the default), no such annotation is requested at all, leaving deployments
+// not yet using this delivery path unaffected.
+func TestAllocateRequestsAWorkloadTokenAnnotationWhenConfigured(t *testing.T) {
+	secret := []byte("agones-integration-secret")
+	var gotAnnotations map[string]string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var body allocationRequest
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			t.Fatal(err)
+		}
+		gotAnnotations = body.Spec.Metadata.Annotations
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"status":{"state":"Allocated","gameServerName":"gs-a","address":"203.0.113.9","ports":[{"name":"default","port":7777}]}}`))
+	}))
+	defer server.Close()
+
+	now := time.Unix(1000, 0)
+	client := Client{BaseURL: server.URL, Namespace: "games", HTTP: server.Client(), WorkloadSecret: secret}
+	if _, err := client.Allocate(context.Background(), request(), map[string]string{"cosmic-clash/region": "EU"}, now); err != nil {
+		t.Fatal(err)
+	}
+	token := gotAnnotations["cosmic-clash.io/workload-token"]
+	if token == "" {
+		t.Fatal("Allocate did not request a cosmic-clash.io/workload-token annotation with WorkloadSecret configured")
+	}
+	claims, err := workload.ParseSignedWorkloadToken(secret, token, now.Add(time.Second))
+	if err != nil {
+		t.Fatalf("minted token does not verify against the same secret: %v", err)
+	}
+	if claims.AllocationID != "allocation-1" {
+		t.Fatalf("token names allocation %q, want %q", claims.AllocationID, "allocation-1")
+	}
+
+	gotAnnotations = nil
+	unsigned := Client{BaseURL: server.URL, Namespace: "games", HTTP: server.Client()}
+	if _, err := unsigned.Allocate(context.Background(), request(), map[string]string{"cosmic-clash/region": "EU"}, now); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := gotAnnotations["cosmic-clash.io/workload-token"]; ok {
+		t.Fatal("Allocate requested a workload-token annotation with no WorkloadSecret configured")
+	}
+}
+
 func TestAllocateFailsClosedOnMalformedProviderResponses(t *testing.T) {
 	cases := []string{
 		`{"status":{"state":"UnAllocated","gameServerName":"gs","address":"127.0.0.1","ports":[{"name":"default","port":7777}]}}`,