agent(openclaw): trust oauth proxy identity

services/openclaw/configmap.yaml

@@ -30,11 +30,9 @@ data:
       "gateway": {
         "mode": "local",
         "auth": {
-          "mode": "token",
-          "token": {
-            "source": "env",
-            "provider": "default",
-            "id": "OPENCLAW_GATEWAY_TOKEN"
+          "mode": "trusted-proxy",
+          "trustedProxy": {
+            "userHeader": "x-forwarded-email"
           }
         },
         "port": 18789,

services/openclaw/deployment.yaml

@@ -23,7 +23,7 @@ spec:
         ai.bstein.dev/instructions: kubectl-field-selectors
         ai.bstein.dev/role: testing-triage
         ai.bstein.dev/placement: arm64 gateway lane (jetson preferred)
-        ai.bstein.dev/config-rev: "20260520-agent-origin"
+        ai.bstein.dev/config-rev: "20260520-agent-trusted-proxy"
     spec:
       serviceAccountName: openclaw-triage
       automountServiceAccountToken: true
@@ -187,11 +187,6 @@ spec:
               value: https://scm.bstein.dev
             - name: GRAFANA_BASE_URL
               value: https://metrics.bstein.dev
-            - name: OPENCLAW_GATEWAY_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: openclaw-secrets
-                  key: OPENCLAW_GATEWAY_TOKEN
           volumeMounts:
             - name: home
               mountPath: /home/node/.openclaw