Issue Agenta Credential

Narrow an invocation credential to its resolved callback tools.

Three guards, because the value this hands back travels into a sandbox:

• Only the API-created service token contains gateway_run_id. Browser and API-key callers therefore cannot mint a credential for Agenta tools at all.
• The caller must hold the permission that governs SPENDING the MCP gateway, which is where the issued credential is spent (MCPGatewayService.relay authorizes the same one on every call). A credential can then never reach a plane its buyer could not reach.
• The tool list is bounded rather than signed as given (:func:entitled_agenta_tools): a credential already carrying a tool set may only narrow it, and one carrying none may still only name call_refs POST /tools/call would dispatch.

The issued value is confined to the gateway audience, like the one POST /gateways/credentials hands the sandbox for every other MCP server. That is what makes the bound hold: an audience-bound credential cannot reach this route (it is not a data-plane path), so the narrowed credential can never buy a wider one.