Inconsistent startup validation and weak observability for router public key/JWT bootstrap

Description

While reviewing the auth bootstrap flow across Router, WorkloadManager, and PicoD, I noticed that missing or malformed router public keys can allow some components to start successfully and only fail later at runtime.

This can surface as pod crashloops instead of early, actionable startup errors, and in some cases failures are logged only at higher verbosity levels.

Observed Behavior

WorkloadManager

• InitPublicKeyCache() retries forever in a goroutine and logs failures only at klog.V(2).
• GetCachedPublicKey() returns an empty string until loaded, so pod specs can still be built and scheduled.
• No validation that public.pem is a valid RSA public-key PEM before caching/injecting.

Router

• Can start outside the cluster without persisting a Secret (falls back to in-memory keys).
• One error message lacks namespace/name context.
• Comment references “ConfigMap” although the implementation uses Secrets.

PicoD

• Fails fast if PICOD_AUTH_PUBLIC_KEY is missing or malformed (good).
• Logs only that it loaded from an “environment variable”, without clarifying the origin.
• No focused unit tests for failure modes (missing env var, malformed PEM, wrong key type).

Why This Matters

• Operators may only see failures at workload runtime.
• Misconfiguration is hard to diagnose.
• Key-rotation or bootstrap errors become flaky-looking production issues.
• Security-critical paths deserve early validation and clear signals.

Proposed Improvements

• Validate router public keys when reading Secrets (PEM parse + require RSA public key).
• Emit warning/error-level logs after repeated bootstrap failures in WorkloadManager.
• Improve log clarity around key source selection (ENV vs Secret, without leaking data).
• Fix Router comments and include namespace/name in error messages.
• Add unit tests in PicoD for env-based key loading failure modes.

Context

I was auditing this flow while preparing contributions for the AgentCube auth/authorization project and tracing startup behavior across components.

Happy to take this up and submit a PR if the maintainers agree with the direction.
@hzxuzhonghu @YaoZengzeng