Authenticate A2A requests and fix jwt-validation pipeline reload

[yoavkatz]

Summary

Wire a Keycloak bearer token through the A2A evaluation path so requests are accepted by the agent's authbridge sidecar, and fix the pipeline merge so jwt-validation reloads instead of failing with issuer is required.

Changes

• a2a_client.py — attach Authorization: Bearer from config.auth_token (A2A_AUTH_TOKEN) to the agent-card fetch and every send_message.
• evaluate-benchmark.sh — obtain a rossoctl-realm token via the direct-access-grant flow when A2A_AUTH_TOKEN is unset (mirrors the deploy flow).
• pipeline-merge.py — seed each plugin entry from the operator's rendered config block (deep-merging fragment + overrides on top) instead of replacing the plugin list wholesale, preserving operator-only config such as jwt-validation's issuer and token-exchange's token_url.
• plugins/jwt-validation.yaml — render issuer/keycloak_url/keycloak_realm from the operator authbridge-config ConfigMap; document the DisallowUnknownFields schema constraint.
• apply-pipeline.sh — source JWT_VALIDATION_* from the base ConfigMap and pre-flight fail if the issuer can't be resolved while jwt-validation is active.
• deploy-agent.sh — fail fast with a clear message when python3/PyYAML is missing and a plugin selector was supplied.
• run-ibac-comparison.sh — new wrapper to run a benchmark with a plugin preset vs a baseline and compare.

Test plan

• Deploy an agent with a plugin preset and confirm the authbridge sidecar reloads without issuer is required.
• Run evaluate-benchmark.sh and confirm A2A requests are authenticated (no HTTP 401).
• Run run-ibac-comparison.sh end-to-end.

🤖 Generated with Claude Code