fix(cfg,token): remove hardcoded brand identity literals

[devonartis]

Summary

Removes every brand-coupled string literal from internal/cfg/ and internal/token/ (production + tests). The JWT iss claim, the JWT aud override, the TrustDomain default, the DBPath default, and the FHS config search paths all hardcoded "agentauth" (or "agentauth.local", "./agentauth.db", /etc/agentauth/...) into source. This PR makes them configurable, defaults them to brand-neutral values, and migrates the test surface to brand-neutral fixture values in one pass.

Resolves: TD-TOKEN-001, TD-TOKEN-002, TD-TOKEN-003, TD-CFG-001, TD-CFG-002, TD-TEST-001 (all marked RESOLVED in TECH-DEBT.md).

What changed

Production:

• cfg.Issuer field added (env AA_ISSUER); empty = skip issuer enforcement on Verify() (mirrors documented Audience contract)
• Issuer check moved out of TknClaims.Validate() (now pure structural — sub, jti, exp, nbf only) into TknSvc.Verify() where cfg is available
• cfg.go:96 Audience override "" -> "agentauth" deleted; honors documented "empty = skip" contract
• TrustDomain default "agentauth.local" -> "agentwrit.local"
• DBPath default "./agentauth.db" -> "./data.db"
• Config search paths /etc/agentauth/config -> /etc/broker/config, ~/.agentauth/config -> ~/.broker/config
• Generated config file header # AgentAuth Configuration -> # Broker Configuration
• Package doc comments in tkn_claims.go updated (no more "the issuer is always 'agentauth'")

Tests:

• Test fixtures across cfg/, token/, authz/, deleg/, admin/, identity/, mutauth/ updated to use brand-neutral values: Issuer: "test-issuer", TrustDomain: "test.local", spiffe://test.local/...
• 6 locked-in assertions in tkn_svc_test.go and val_mw_test.go now drive from fixture cfg instead of literals
• 3 cfg.Cfg{} literal constructions in tkn_svc_test.go, deleg_svc_test.go, admin_svc_test.go now include Issuer: "test-issuer"
• TestLoad_AudienceDefault now asserts empty-when-unset (the actual contract)
• TestLoad_DBPathDefault now asserts ./data.db

Root cause

IssuerURL was an OIDC-coupled cfg field stripped during the open-core split. The strip removed the field, the validation, AND the config-driven tests (tombstone preserved at internal/token/tkn_svc_test.go:521), but the validation was replaced with a hardcoded "agentauth" literal rather than left configurable. The general JWT iss claim is independent of OIDC and core still needs it. This PR restores configurability without re-coupling to OIDC.

Full audit at .plans/reviews/2026-04-10-hardcoded-identity-audit.md.

Standing rule

~/.claude/CLAUDE.md now contains "No Hardcoded Identity Values — Universal, Non-Negotiable" as a global rule across all projects. Identity-shaped string literals in source code are now non-negotiable findings.

Test plan

• go build ./... clean
• go vet ./... clean
• gofmt -l internal/ cmd/ returns empty
• go test ./internal/... — 14/14 internal packages pass locally
• CI: format, build, vet, lint, unit-tests, unit-tests-race, gosec, govulncheck, go-mod-verify, contamination, docker-build, smoke-l25, sbom all green
• CI: gates-passed aggregator green (required for merge)
• Behavioral spot-check after merge: boot broker with AA_ISSUER=foo, issue a token, verify iss claim is "foo". Boot without AA_ISSUER, verify the iss check is skipped on Verify.
• Confirm no acceptance test env.sh files broke (they don't set AA_ISSUER, but that's fine — empty = skip)

What this PR does NOT do

• Does NOT add fail-fast validation for missing config (operator responsibility)
• Does NOT touch aactl init interactive flow (separate work)
• Does NOT update example JWT payloads in user-facing docs (docs/api.md, docs/common-tasks.md, docs/foundations.md, docs/implementation-map.md still show "iss": "agentauth" — separate cleanup item)
• Does NOT rename aactl -> awrit binary (TD-CLI-001, separate PR)
• Does NOT add a config-matrix CI job to verify tunables at runtime (deferred — flagged in the action plans for the next PR that adds a tunable)