chore(a2a-maintain): fix keys-broker card/bundle skill conflation

[izzywdev]

Summary

Fleet-wide A2A verification pass (a2a-maintainer) for this repo. FuzeKeys already had
its own side of the A2A surface built (a2a.enabled: true, keys-broker serving role
with a real description, providesTo populated, root CLAUDE.md, deterministic
broker core at backend/app/broker) — this PR fixes the one thing that was still
wrong and adds the one thing that was missing, per governance/a2a-runtime-standard.md
(FuzeSDLC) and its enforcement, scripts/gate_a2a.py.

• Fixed (fatal, S2 — always fatal, never ratcheted): agent-templates/roles/keys-broker/role.json
skills[] still carried keys.grant / keys.redeem / keys.mint_token / keys.revoke.
  Those are A2A card skill-ids (they already live correctly in a2a.examples and in
  backend/app/broker/mcp_tools.py), not filesystem skill bundles — exactly the
  card-skill/bundle-skill conflation the standard names as this repo's live bug (§4).
  Removed them from skills[].
• Built (fatal, S3 — anti-vacuous adoption): with the dotted ids removed, the role
  declared zero bundle skills, which the standard treats as a finding, not a pass ("an
  A2A pod with no skills is a Claude SDK with no product knowledge"). Added a real
  bundle, .claude/skills/credential-broker-mediation/SKILL.md, naming that in
  skills[]. The skill documents the session's operating contract over the
  already-implemented deterministic core (backend/app/broker, see its
  README.md) — non-disclosure of raw secret material, transport-identity-only authz,
  human-gating of high-sensitivity releases, attenuation-only-narrows. It adds no new
  broker behavior; it packages the existing documented invariants for the mounted
  session.
• Corrected role.json's metadata.skillsFix note to record why this changed.

Verified

$ python3 scripts/gate_a2a.py . --all   # (FuzeSDLC's gate, run against this repo — not re-derived)

# BEFORE:
gate-a2a: repo=izzywdev/FuzeKeys a2a=enabled values-docs=0 policy=NONE — strict defaults (absence is not permission) adoption=enforcing
::error::gate-a2a I0  (no chart a2a: block)
::error::gate-a2a S2  skills[] contains `keys.grant` ...
::error::gate-a2a S2  skills[] contains `keys.redeem` ...
::error::gate-a2a S2  skills[] contains `keys.mint_token` ...
::error::gate-a2a S2  skills[] contains `keys.revoke` ...
::error::gate-a2a S3  no serving role declares any bundle skill
gate-a2a: 6 finding(s), 6 fatal

# AFTER:
gate-a2a: repo=izzywdev/FuzeKeys a2a=enabled values-docs=0 policy=NONE — strict defaults (absence is not permission) adoption=enforcing
::error::gate-a2a I0  .fuze/manifest.json
  a2a.enabled is true and NO chart values file in this repo carries an `a2a:` block...
gate-a2a: 1 finding(s), 1 fatal

Also verified role.json still validates against
agent-templates/schema/role-manifest.schema.json (jsonschema.validate, passes).

I0 is expected here, not something this PR fixes

The remaining I0 finding (a2a.enabled: true, no chart a2a: block) is this repo's
documented, intentional design, not an unbuilt pod: docs/a2a-tenant-registration.md
and the .fuze/manifest.json a2a._note both explain that FuzeKeys is served as a
tenant of FuzeAgent's shared multi-tenant A2A server
(ghcr.io/izzywdev/fuzeagent-a2a), not a per-product pod in this chart — the card
generator's IN_CLUSTER_URL is a structural constant, so a local pod here would start,
pass its probes, and publish the shared server's endpoint, serving nothing. Building a
chart pod to silence this finding would contradict that documented design and would be
exactly the "green because nothing checks the real thing" pattern the standard exists to
prevent. The actual precondition (the FuzeKeys tenant entry in FuzeAgent's
deploy/helm/a2a-shared/values-prod.yaml) is a cross-repo change in izzywdev/FuzeAgent,
outside this repo's PR.

providesTo (18 entries) was reconciled against FuzeSDLC's
governance/a2a-dependency-graph.json repos.FuzeKeys.providesTo — identical sets
(order differs only), so no change made.

No secret value was read, printed, or written at any point — only names/keys/refs.

Test plan

• python3 scripts/gate_a2a.py <clone> --all run before and after (output above)
• role.json validated against role-manifest.schema.json
• CI (harden-gate.yml / a2a-maintain.yml) green on this PR

[github-actions]

fuze-code-review — automated verdict

No verdict was reached — this run is NOT an approval.

fuze-code-action conclusion was 'failure', not 'success' — no review was produced, so none can be approved. See the per-rung 'fuze-code-action' notices in the job log for the specific classification (availability / task / declined) and, on an availability failure, the named provider error that triggered it.

This is reported as a failed check deliberately: a review that could not run must never be silently indistinguishable from a clean one.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.06%. Comparing base (294c0a0) to head (af646bf).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #189   +/-   ##
=======================================
  Coverage   41.06%   41.06%           
=======================================
  Files          81       81           
  Lines        6171     6171           
  Branches      252      252           
=======================================
  Hits         2534     2534           
  Misses       3634     3634           
  Partials        3        3           

Flag	Coverage Δ
backend	41.06% <ø> (ø)
frontend	41.06% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.