feature: rossoctl schedule — cross-cluster missions + CloudEvents audit (Phase 3)

Feature Description

Epic: kagenti/kagenti#1460 (Authorization and Identity for Event-Driven Agent)
Sibling phases: #1917 (Phase 1 — CRD + controller + mint), Phase 2 (CLI surface)

This is Phase 3 of the rossoctl schedule feature, split out of #1917. It adds cross-cluster mission federation, human-in-the-loop approval, and the CloudEvents audit trail. It depends on epic #1460's Phase 3 (cross-cluster identity) and on Phases 1–2 of this feature being in place.

Scope

Cross-cluster missions (--cluster)

• --cluster <name> triggers RFC 8693 token exchange so a mission minted in the local trust domain is accepted by a remote cluster
• Federated JWKS: the remote cluster's Event Bridge Proxy verifies the mission token against the local cluster's published keys
• Cross-domain grant validation (remote EventAuthPolicy trusts the federated SPIFFE ID)

Human-in-the-loop approval (--approve-policy notify, --notify)

• --approve-policy notify requires a human tap per run instead of pre-approval at schedule time
• --notify slack:#ops (and similar channels) for mission start / end / failure notifications

CloudEvents audit trail

• Every schedule trigger, mission mint, resource access, and expiry emits a CloudEvent (gated by KAGENTI_FEATURE_EVENTING)
• Audit events carry the mission ID so actions trace back to the approved mission

Acceptance criteria

• A schedule created with --cluster <remote> mints a mission token that a remote-cluster proxy accepts via RFC 8693 token exchange + federated JWKS
• --approve-policy notify blocks execution until a human approves; auto runs without prompting (Phase 2 default)
• --notify <channel> delivers start/end/failure notifications
• Each mission lifecycle event (trigger, mint, access, expiry) emits a CloudEvent carrying the mission ID when KAGENTI_FEATURE_EVENTING=true
• With eventing disabled, scheduling still works HTTP-only with no CloudEvents emitted

Dependencies

• Epic #1460 Phase 3 (token exchange, federated JWKS) — this issue consumes that work
• This feature's Phase 1 (#1917) and Phase 2 (CLI surface)

References

• Parent epic: kagenti/kagenti#1460
• Original (now Phase 1): kagenti/kagenti#1917
• Token exchange: kagenti/kagenti-extensions#184 (referenced by the epic's Phase 3)
• RFC 8693 (OAuth Token Exchange)