proofs: a tenant step — a person RBAC denies gets an empty roster and no session through the edge, the same answer as the Dev Portal

[teemow]

Problem

The migration rehearsal (#143) measured on 2026-09-12 that the two roster surfaces disagree for a person whom Kubernetes RBAC denies list agenttemplates: agentlab turn --user dev@lab.local --list returned all three templates through the edge (the controller's ListAgentTemplates), while the Dev Portal's read through the Kubernetes proxy answers 403 for the same person. The product decision on epic giantswarm/giantswarm#37705 (2026-09-12) is that agents are tenant-scoped within an installation, with Kubernetes RBAC as the source of truth. The lab has no proof for it.

Proposed solution

A tenant step in the existing proofs (platform-test or agents-test), run as the lab's non-admin person:

• dev@lab.local (denied list agenttemplates by the lab's tenant RBAC) gets an empty roster through the edge and PermissionDenied on a session create; a turn attempt fails before the model is called.
• admin@lab.local keeps the full roster and a working turn (the existing steps).
• A tenant-bound role (a Role granting get on one named AgentTemplate plus create on agentinstances) lets the person see and use exactly that agent.
• The Dev Portal step (backstage-test) asserts the same set for the same person, so both surfaces give one answer.

The step passes only with the controller-side authorization from giantswarm/giantswarm#37761 (a carried patch on giantswarm/kagent-upstream) deployed (through platform.devImages while unreleased); until then it reports the gap as a known failure with the issue link rather than skipping.

Acceptance criteria

• agentlab platform-test (or agents-test) has a tenant step covering denied, admin and tenant-bound persons, edge and portal.
• Green against a lab running the kagent-upstream patch; red with a clear message on a controller without it.
• docs/identity.md describes the tenant model the proof asserts.