feat(cli): enroll with an auth key, through the daemon (#175)

[gen16k]

waired#976 gave the control plane auth keys — the credential a headless host presents instead of a person completing a browser sign-in. This is the client half, and it removes the first of the two remaining local-enrollment selectors.

The key is a credential, not a route selector

chooseEnrollRoute gains an authKey fact that outranks every local selector: a run carrying a key reaches the daemon or fails saying why. It must never fall back — falling back drops the credential on the floor and registers a device whose capabilities the control plane never learns, which is the exact failure #175 exists to remove. Six new table cases pin it, including --auth-key overrides --bypass-mode.

Value resolution

resolveAuthKey is a pure function over three forms:

Form	Use
--auth-key waired_ak_…	the key itself
--auth-key file:/path/to/key	preferred on a shared host — argv is visible in ps
$WAIRED_AUTH_KEY	containers; the key never enters argv at all

Surrounding whitespace is always trimmed: a key written with echo … > key carries a newline, and a key that fails only because of an invisible character is a miserable thing to debug. The file leg takes an injected reader that records the path it was asked for, plus one test through the real os.ReadFile so the production wiring is actually exercised.

On the wire

• auth_key is sent only when there is one. An older control plane decodes with DisallowUnknownFields, so an empty field would 400 every interactive enrollment.
• When the create response carries a registration_ticket, RunInit skips OnLoginURL and the entire poll loop — the session was authorized inside that call. Offering a login URL nobody can open is worse than useless on a headless host. There is a test asserting the poll count is exactly zero.
• The second half of enrollment is now enrollWithTicket, shared by both ways of obtaining the ticket.
• A refused key fails immediately instead of falling through to a browser flow that would hang until the poll timeout.
• The old-CP 400 is rewritten into "this control plane does not support auth keys yet" — otherwise it reads as "your key is malformed".

LoginStartRequest.AuthKey carries it to the daemon. That type lives in internal/management, not proto/ — no tag, no CP-side bump. And /login/start is a mutating verb, which the management server's write guard already confines to the local IPC socket, so the key never crosses the TCP listener.

Removed

--google-sa-login, --impersonate-sa, --oidc-id-token, --oidc-audience and cmd/waired/oidc_grant.go. Worth noting: only --bypass-mode was buildflag-gated — those four shipped in the production CLI, driving a second, capability-less enrollment implementation.

installtest: oidc → authkey, on all three OSes

The host still mints the SA id_token with gcloud (the guests have no gcloud), but now exchanges it once for a reusable auth key at the CP's dev issuer, and the guest enrols with the daemon up. So the leg exercises the journey a real headless install takes, instead of stopping the daemon to force a path production never uses. The Hyper-V edge verify moves the same way.

The key is minted per run and reused across guests — both the fleet case a real operator has, and what keeps every guest in one network for the Tier-3 overlay ping.

Two legs deliberately keep the old shape

• --daemon-engine (macOS/Windows) still completes an ordinary login out-of-band with the raw token. Its whole point is watching the resident executor install the engine while init is mid-flight; an auth key authorizes the session in the create call, so there would be no window left to observe.
• --bypass-mode stays. The testnet container uses it, and flipping that needs waired#982's terraform plumbing deployed first. It goes in the follow-up, together with build/agent-bootstrap.sh.

Secrets

Adds a gitleaks rule for waired_ak_ + 64 hex. The default ruleset has no pattern for it, this repo is public, and a leaked key admits a device to someone's network until it expires or is revoked. Doc examples use short waired_ak_... placeholders that do not match, so no allowlist is needed.

Verification

• go build ./..., go vet ./..., go test ./... — green
• go build -tags prod ./... + go vet -tags prod ./... + go test -tags prod ./internal/buildflag/... — green
• make verify-cross — green
• golangci-lint run — 0 issues
• docs-site: i18n-sync --check → 32 pairs in sync (EN + JA both written, not just hash-accepted)
• scripts/ci/decision-log-guard.py — green

Not verified locally: the 3-OS installtest legs, which need the dev control plane. CI runs them on this PR — that is the real test of the migration. The POST /test/auth-key issuer they call is live on app.dev.waired.net as of waired#978's deploy.

New tests: resolveAuthKey (13 cases incl. every failure), the real-os.ReadFile wiring, the old-CP error classifier, six route-table cases, and three wire-level tests — auth key skips the poll loop, no key omits the field entirely, a refused key never enrolls.

Refs #175

[github-actions]

📘 Docs preview for this PR: https://waired-docs--pr-290-du3sdaff.web.app

Rebuilt on each push; the preview channel auto-expires in 7 days.