Dapr workflow commands in Kubernetes mode fail with Unauthenticated against sidecars secured with a api-token-secret

## Expected Behavior

`dapr workflow list`/`dapr workflow history` (and other `dapr workflow ... -k` sub commands) should succeed against a Kubernetes app whose sidecar has `dapr.io/api-token-secret` set, when `DAPR_API_TOKEN` is exported with the correct token value.

## Actual Behavior

Every `dapr workflow ... -k` subcommand fails with:

```console
rpc error: code = Unauthenticated desc = Unauthorized
```

gRPC debug logging (`GRPC_GO_LOG_SEVERITY_LEVEL=info GRPC_GO_LOG_VERBOSITY_LEVEL=2`) shows the CLI's internal port-forward to the sidecar's gRPC port succeeds and the channel reaches `READY`, but the RPC itself is rejected, which points to the `dapr-api-token` metadata simply not being attached to the outgoing call.

Port-forwarding the sidecar's HTTP port directly and calling `/v1.0/workflows/dapr/` with the same token as an HTTP header returns `200 OK` with full workflow status. So the token is valid, but it seems like the CLI's `workflow` gRPC client just isn't sending it.

## Steps to Reproduce the Problem

1. Deploy an app to Kubernetes with Dapr sidecar injection and `dapr.io/api-token-secret: ` set, on Dapr runtime `1.18.3`.
2. Start at least one workflow instance.
3. From a machine with `kubectl` access to the cluster and `dapr` CLI `1.18.2` installed:
```bash
export DAPR_API_TOKEN=$(kubectl -n get secret -o jsonpath='{.data.token}' | base64 -d)

dapr workflow list -a -n -k
# → Unauthenticated: Unauthorized

dapr workflow history -a -n -k
# → Unauthenticated: Unauthorized
4. Confirm the token is valid by port-forwarding the sidecar's HTTP port (3500) directly to the pod and calling:
```console
curl -H "dapr-api-token: $DAPR_API_TOKEN" http://localhost:3500/v1.0/workflows/dapr/
# → 200 OK with instance status/history
```

## Release Note

RELEASE NOTE: **FIX** dapr workflow commands in Kubernetes mode (-k) failing with Unauthenticated against sidecars secured with dapr.io/api-token-secret

Start by tracing the CLI's workflow gRPC client in Kubernetes mode (-k), including how DAPR_API_TOKEN is read and how calls through the internal port-forward are authenticated. Reproduce with `dapr workflow list` or `history` against a token-secured sidecar, then verify the commands succeed and no longer return Unauthenticated.

Written by the indexing model from the issue text.