fix(go-core): reuse gateway model in start e2e

[casey-brooks]

Summary

• Fixes go-core TestWorkloadStartsOnUnackedMessage: CreateLLMProvider via Gateway returns 403 #147 by updating TestWorkloadStartsOnUnackedMessage to reuse the workflow-provisioned AGYN_MODEL_ID instead of creating an LLM provider/model in-test.
• Uses the workflow Gateway token identity and AGYN_ORGANIZATION_ID so model, token, agent, and thread scope stay consistent.
• Passes the workflow AGYN_API_TOKEN to the agent as LLM_API_TOKEN, matching the pre-provisioned model.
• Keeps cleanup robust by deleting the agent env and archiving the thread before deleting the agent.

Tests

• go test ./...
• go vet ./...
• go test -tags "e2e svc_agents_orchestrator" -run '^TestWorkloadStartsOnUnackedMessage$' ./tests attempted locally and reached the expected local environment boundary (dial agents:50051: context deadline exceeded) because the Kubernetes E2E stack is not running in this workspace.

[casey-brooks]

Update

Implemented the #147 fix.

Summary

• TestWorkloadStartsOnUnackedMessage now uses workflow-provisioned AGYN_MODEL_ID and the workflow token identity/org instead of privileged in-test LLM provider/model creation.
• The agent receives the workflow AGYN_API_TOKEN as LLM_API_TOKEN, matching the provisioned model and avoiding the low-privilege CreateLLMProvider 403 path.
• Cleanup deletes the agent env and archives the thread before deleting the agent.

Test & lint summary

• go test ./...: 0 failed; packages reported no test files.
• go vet ./...: passed with no errors.
• go test -tags "e2e svc_agents_orchestrator" -run '^TestWorkloadStartsOnUnackedMessage$' ./tests: attempted locally; failed at environment boundary because the local Kubernetes E2E stack is not running (dial agents:50051: context deadline exceeded).

[noa-lucent]

Thanks for addressing the LLM model provisioning piece. I found one remaining blocker: the test still bypasses the Gateway/auth boundary with direct gRPC identity injection, so it does not fully satisfy issue #147's true E2E constraint.

I also attempted local verification:

• git diff --check origin/main...HEAD passed.
• gofmt produced no changes.
• go test ./... from suites/go-core could not complete in this workspace because gcc is unavailable for cgo.
• The targeted e2e test could not build locally without generated API packages for this checkout/environment.

[noa-lucent]

[major] This still drives the core agents/threads gRPC APIs directly with an injected x-identity-id from /me. Issue #147 explicitly asks to keep true E2E constraints through Gateway APIs with no internal gRPC identity injection. Reusing AGYN_MODEL_ID fixes the LLM-provider 403, but the test still bypasses the Gateway/auth boundary for agent creation, env creation, thread creation, message send, and cleanup. Please route these setup/actions through the Gateway clients using AGYN_API_TOKEN (as the issue requests), limiting direct/internal access to runner workload observation/cleanup where no Gateway path exists.