[Agent] Implement registration and outbound mTLS enrollment

[mohit-nagaraj]

Context

The connector must enroll without an uploaded kubeconfig or long-lived shared secret. The control plane contract is defined in KubeOrch/core#122; this issue implements only the cluster-side one-time registration and outbound mTLS identity lifecycle.

Outcome

A fresh agent can exchange a one-time registration credential for a workspace-bound mTLS identity, establish an authenticated outbound connection, and recover safely across restart without replaying enrollment.

Scope

• Consume the approved registration contract and generated protocol fixtures from Core.
• Read the one-time registration credential from a mounted file or Secret reference, never a command-line flag.
• Perform enrollment over verified TLS and persist the issued identity using a restrictive filesystem/Secret abstraction.
• Establish the outbound mTLS session with explicit server-name and audience validation.
• Handle certificate expiry/rotation according to the control-plane contract.
• Delete or invalidate local enrollment material after successful exchange.
• Add bounded exponential reconnect behavior without creating multiple concurrent sessions.

Out Of Scope

• Kubernetes resource watches, command execution, logs/exec, Helm RBAC, or direct apply.

Acceptance Criteria

• Enrollment is one-time and an attempted replay is rejected.
• The agent refuses plaintext control-plane URLs outside an explicit local-development mode.
• Server certificate, name, protocol version, agent audience, and workspace/cluster identity are validated.
• Private keys and registration material are never logged or included in health output.
• Restart reuses a valid identity without re-enrollment.
• Revoked, expired, or mismatched identities cannot establish a session.
• Backoff is bounded, jittered, cancellable, and single-flight.

Verification

• Contract tests against the Core fake-agent harness.
• Replay, wrong-audience, wrong-workspace, expired, revoked, and rotation tests.
• Restart and concurrent-session tests.

Dependencies

Blocked by KubeOrch/core#122 and the agent scaffold issue.

Documentation And Observability

Document certificate storage, rotation, recovery, and operator-visible connection states. Emit connection metrics using only non-sensitive IDs.