fix: enforce agent gateway member credentials
Summary
Keep agent gateway requests bound to the member's selected or attached upstream credentials. Reject unavailable or unauthorized connections instead of falling through to anonymous upstream requests.
Impact
Missing, revoked, or replaced attachments fail closed. Same-source reconnects remain usable, and header-only, no-auth, and hosted members retain their existing credential paths.
Technical details
This PR depends on #8275 for atomic publication of typed authentication clients. Authorization checks use the existing catalog and exact attached connection without repairing authority during requests.
Summary by cubic
Enforces that agent gateway member requests stay bound to the member's selected or attached upstream credentials. Missing, revoked, or replaced attachments now fail closed instead of falling through to anonymous upstream requests, and client eligibility is scoped to the member's server so sibling-server or issuer-shared clients cannot supply credentials.
- Same-source reconnects continue to use the current credentials.
- Header-only, no-auth, and hosted members keep their existing credential paths.
- A resolved token that does not route to the member denies instead of dialing anonymously.
- Serving never repairs attachment authority during requests; denied connections resolve zero tools upstream.
- Depends on #8275 for atomic publication of typed auth clients.