Task: exchange the demo github-agent's calls to the production github-tool-mcp under token-exchange-aiac #247

Background

PR #242 switches the AuthBridge outbound leg from token-exchange (one route per host in authproxy-routes) to token-exchange-aiac. The new plugin has no routes: it derives the audience from the destination host as spiffe://<td>/ns/<ns>/sa/<host>, and only a default client scope of the caller's client grants a target. The demo no longer ships authproxy-routes.

The removed route did two things for the demo github-agent's live GitHub calls:

- host: "github-tool-mcp"
  target_audience: "github-tool"
  token_scopes: "openid github-tool-aud github-full-access"

Neither has a replacement:

1. No exchange. The agent's MCP_URL is http://github-tool-mcp:9090/mcp. The production tool's Service is github-tool-mcp, but its ServiceAccount (and so its Keycloak client) is github-tool. The derived audience …/sa/github-tool-mcp names no client, so the call passes through with the user's un-narrowed token, and the tool's jwt-validation rejects it.
2. No github-full-access. The production tool reads that scope to pick a GitHub PAT. The plugin requests no scope, so the scope reaches a token only if it is a default scope of github-agent's client.

The UC-1 onboarding demo and the system tests are not affected: they call the stub github-tool (Service = ServiceAccount = github-tool) directly. PR #242 records this as a known limitation in demo/assets/INSTALL.md.

Raised in the review of #242: #242 (comment)

Task

Make the demo agent's tool calls to the production tool exchanged again under token-exchange-aiac. Decide between:

• aligning the production tool's Service with its ServiceAccount (its manifest is cortex authbridge/demos/github-issue/k8s/github-tool-deployment.yaml, outside this repo), or
• pointing MCP_URL at a Service whose name equals the tool's ServiceAccount.

Then grant github-full-access as a default client scope of github-agent (in the demo's wiring, not as a realm default).

Files

• demo/assets/agents/github_agent/k8s/github-agent-deployment.yaml (MCP_URL, the header note)
• demo/assets/agents/github_agent/.env.*, github_agent/config.py (the MCP_URL default)
• demo/assets/INSTALL.md (remove the known-limitation note)
• docs/specs/demo/github-agent.md (the wiring invariant)
• cortex authbridge/demos/github-issue/k8s/github-tool-deployment.yaml, if the Service is renamed

Acceptance criteria

• A live tools/call from github-agent to the production tool is exchanged: the tool's sidecar receives a token whose audience is the tool's client.
• That token carries github-full-access, and the tool selects its PAT.
• No authproxy-routes and no realm default scope are added.
• INSTALL.md and docs/specs/demo/github-agent.md describe the new wiring, and the known-limitation note is gone.