refactor: remove legacy controller runtime - #2595

The inventory wiring lived in the legacy controller application, deleted by
#2595, and controller-v2 never carried it over. `grpcserver.New` then falls
back to a system service constructed with no options, so it holds no
Kubernetes client and every namespace read returns an internal error.

The UI reads templates one namespace at a time, so the namespace list is an
input to that read rather than a detail beside it: the agents page reports the
failure as "Could not load agents — internal server error" and lists nothing.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Signed-off-by: Nicholas Bucher <[email protected]>

---
*🤖 written by Claude (start)*

## Summary

Removes the dead `A2A_BASE_URL` chart config. Nothing reads it:
`controller-v2` takes its gateway URL from `A2A_GATEWAY_URL`, and the
HTTP A2A server on `:8083` that `a2aBaseUrl` addressed was deleted with
the legacy runtime in #2565 / #2595.

Drops the `controller.a2aBaseUrl` value, the `kagent.a2aBaseUrl` helper
and its now-orphaned doc comment, the configmap key, and the two chart
tests covering it.

Carries @jjamroga's #2578 with `main` merged in. That PR's Go changes
are already on `main` via #2595 — which deleted `go/core/pkg/app`
outright — so this chart cleanup is all that remains of it.

## Testing

1. `cd helm && helm unittest kagent`
2. `helm template kagent helm/kagent | grep A2A_` — only
`A2A_GATEWAY_URL` should appear.

## Release Notes

```release-note
NONE
```

---
*🤖 written by Claude (end)*

Signed-off-by: Jonathan Jamroga <[email protected]>
Co-authored-by: Jonathan Jamroga <[email protected]>

…cator

The chart renders AUTH_MODE and AUTH_USER_ID_CLAIM on the controller
(controller.auth.mode, controller.auth.userIdClaim) and
docs/OIDC_PROXY_AUTH_ARCHITECTURE.md describes the two modes, but since
the legacy runtime went (kagent-dev#2595) nothing reads either variable: the
controller calls app.Run with empty Options, so it always runs the
UnsecureAuthenticator -- any caller names themselves with X-User-Id --
and ProxyAuthenticator has no caller at all. A deployment that sets
controller.auth.mode: trusted-proxy behind oauth2-proxy or an API
gateway gets a controller that admits everyone, and nothing tells it so.

app.AuthenticatorFromEnv selects the built-in authenticator AUTH_MODE
names and the controller's main passes it as Options.Authenticator:

- unset or "unsecure": UnsecureAuthenticator, as today;
- "trusted-proxy": ProxyAuthenticator reading the claim AUTH_USER_ID_CLAIM
  names ("sub" by default) from the bearer the proxy validated; a request
  without a bearer is refused whatever X-User-Id says, and the agent-call
  branch (X-Agent-Name set) is unchanged;
- anything else fails startup naming the valid modes, instead of silently
  running unsecure.

The helper is exported so that a library consumer, which cannot import
the internal auth package, can run core's modes too; Options and Run are
untouched, so a consumer that supplies its own authenticator sees no
change. gRPC callers are covered as before: the authentication
interceptor already maps the authorization, x-user-id and x-agent-name
metadata onto the headers the authenticator reads. The docs table drops
the --auth-mode flags, which went with the legacy runtime.

…cator

The chart renders AUTH_MODE and AUTH_USER_ID_CLAIM on the controller
(controller.auth.mode, controller.auth.userIdClaim) and
docs/OIDC_PROXY_AUTH_ARCHITECTURE.md describes the two modes, but since
the legacy runtime went (kagent-dev#2595) nothing reads either variable: the
controller calls app.Run with empty Options, so it always runs the
UnsecureAuthenticator -- any caller names themselves with X-User-Id --
and ProxyAuthenticator has no caller at all. A deployment that sets
controller.auth.mode: trusted-proxy behind oauth2-proxy or an API
gateway gets a controller that admits everyone, and nothing tells it so.

app.AuthenticatorFromEnv selects the built-in authenticator AUTH_MODE
names and the controller's main passes it as Options.Authenticator:

- unset or "unsecure": UnsecureAuthenticator, as today;
- "trusted-proxy": ProxyAuthenticator reading the claim AUTH_USER_ID_CLAIM
  names ("sub" by default) from the bearer the proxy validated; a request
  without a bearer is refused whatever X-User-Id says, and the agent-call
  branch (X-Agent-Name set) is unchanged;
- anything else fails startup naming the valid modes, instead of silently
  running unsecure.

The helper is exported so that a library consumer, which cannot import
the internal auth package, can run core's modes too; Options and Run are
untouched, so a consumer that supplies its own authenticator sees no
change. gRPC callers are covered as before: the authentication
interceptor already maps the authorization, x-user-id and x-agent-name
metadata onto the headers the authenticator reads. The docs table drops
the --auth-mode flags, which went with the legacy runtime.

…cator

The chart renders AUTH_MODE and AUTH_USER_ID_CLAIM on the controller
(controller.auth.mode, controller.auth.userIdClaim) and
docs/OIDC_PROXY_AUTH_ARCHITECTURE.md describes the two modes, but since
the legacy runtime went (kagent-dev#2595) nothing reads either variable: the
controller calls app.Run with empty Options, so it always runs the
UnsecureAuthenticator -- any caller names themselves with X-User-Id --
and ProxyAuthenticator has no caller at all. A deployment that sets
controller.auth.mode: trusted-proxy behind oauth2-proxy or an API
gateway gets a controller that admits everyone, and nothing tells it so.

app.AuthenticatorFromEnv selects the built-in authenticator AUTH_MODE
names and the controller's main passes it as Options.Authenticator:

- unset or "unsecure": UnsecureAuthenticator, as today;
- "trusted-proxy": ProxyAuthenticator reading the claim AUTH_USER_ID_CLAIM
  names ("sub" by default) from the bearer the proxy validated; a request
  without a bearer is refused whatever X-User-Id says, and the agent-call
  branch (X-Agent-Name set) is unchanged;
- anything else fails startup naming the valid modes, instead of silently
  running unsecure.

The helper is exported so that a library consumer, which cannot import
the internal auth package, can run core's modes too; Options and Run are
untouched, so a consumer that supplies its own authenticator sees no
change. gRPC callers are covered as before: the authentication
interceptor already maps the authorization, x-user-id and x-agent-name
metadata onto the headers the authenticator reads. The docs table drops
the --auth-mode flags, which went with the legacy runtime.