Allow workload identity for cluster-local MCP services

[Andrew Chung (andrewkcchung)]

Summary

• allow deployment-owned workload identity for exact Kubernetes Service FQDNs over cluster-local HTTP
• retain HTTPS for every other remote MCP endpoint
• reject incomplete or lookalike cluster-local names, IP addresses, embedded credentials, and fragments
• document the constrained transport exception

Motivation

PilotSwarm currently owns workload-identity token acquisition and exact-URL header binding for deployment-configured MCP servers. Some deployments expose an MCP server as an internal Kubernetes Service rather than through an HTTPS ingress.

This change accepts only the canonical http://<service>.<namespace>.svc.cluster.local[/path] form for that deployment-owned path. The generated authorization headers remain bound to the exact configured URL. Arbitrary HTTP endpoints remain fail-closed, while external MCP endpoints continue to require HTTPS.

This preserves the current ownership structure: PilotSwarm provides the generic workload-identity transport mechanism, and deployments provide server-specific URLs and scopes.

Validation

• npm run build --workspace=packages/sdk
• node --test packages/sdk/test/unit/mcp-workload-identity.test.mjs
• npm run lint --workspace=packages/sdk
• deployed the PR worker payload to a Kubernetes repository-worker fleet using an exact cluster-local HTTP MCP Service URL
• confirmed the worker acquired and injected deployment-owned workload-identity headers bound to that URL
• completed a bounded read-only MCP tool invocation through the internal Service with no caller credential
• retained rejection coverage for arbitrary HTTP hosts, IP addresses, incomplete names, lookalike suffixes, credentials, and fragments