Use workload identity for worker authentication

Description

Replace worker authentication that depends on persistent refresh-token state with short-lived identity issued per worker. Support Kubernetes-issued service account tokens or SPIRE JWT-SVIDs so workers can restart on another node without shared token storage.

Definition of Done

• Each worker authenticates with a unique, short-lived identity.
• Credentials rotate automatically when they expire or cluster signing keys change.
• Worker restart and rescheduling succeed without a shared cross-node credential store.
• Supported identity providers and configuration are documented for each supported cluster deployment mode.
• End-to-end tests cover initial authentication, rotation, restart, and rescheduling.