Exchange a workspace identity for an API token or a connector credential [identity]

Bearer wid_…. {for: agentsky_api} mints a workspace-fixed ast_ token for the session's owner (read+write, one hour, never past the identity) that reaches the route groups the identity lists and nothing else. {for: connector, kind} attaches the vault the connector names for the identity's role to the session and pushes its network policy, then answers placeholders by environment variable name: export them and send requests to origin; the real credential is set at the network edge and never reaches the pod. Every exchange is recorded and revoked with the session. 404 connector_not_installed, 403 role_not_granted, 409 connector_misconfigured, 400 egress refusals, 503 connector_attach_failed.