[ChrisJBurns]

Closes #2607

Problem

#2653 registered the identity broker's client, mecatl, at hosted AS-1. The broker can now convert a user's sign-in into a refresh token at session open, but ToolHive v0.60.0 left three gaps:

• The broker could mint Mecatl API access tokens as the user. To accept a user's Mecatl API token, mecatl had to list the Mecatl API in its api_audience and its output audiences. That also let it exchange the same token for a fresh Mecatl API access token. The design forbids this (credentials-and-lifecycle.md, step (3)): mecatl must be able to hold only authority for gateway calls. This is the last open "Done when" item in Register the broker client at AS-1 and point the broker at it #2607 (Configured delegate client with api_audience can exchange for API access tokens toolhive#7026).
• Failed client assertions got different errors. An expired or over-long assertion got 500 server_error, which the broker treats as a retryable outage. A reused jti got 400 jti_known. The design expects 401 invalid_client for every failed assertion (Authorization server: refuse every failed private_key_jwt client assertion with 401 invalid_client toolhive#7028).
• AS-1 did not require offline_access on the access token it converts (Authorization server: exchange only access tokens issued with offline_access into refresh tokens toolhive#7029).

ToolHive v0.61.0 fixes all three. Its fix for the first gap also changes the delegate client's configuration in a way that breaks compatibility: api_audience is replaced by an input-only subject_token_audiences.

Solution

• Bump ToolHive to v0.61.0 and run task tidy across all modules.
• Reconfigure the delegate client (internal/identitybroker/adapter/as1server/delegate.go). mecatl now lists the Mecatl API audience only in token_exchange.subject_token_audiences (Separate delegate input audiences from output audiences toolhive#7037), and has no output audiences. It can still turn a user's Mecatl API token into an exchange-grant refresh token. It can no longer obtain a Mecatl API access token, because ToolHive refuses to start if an output audience covers an input one.
• Recognise the new refusal reason. v0.61.0 refuses a token without offline_access with a reason mecatl didn't know, subject_token_offline_access, so the broker dropped it and reported a generic internal error. The broker now knows the reason and treats it as a configuration fault, like subject_token_audience: mecatui always requests offline_access. The design's reason tables list it too.
• Refuse at startup a scope list without offline_access. mecatui requests an advertised --oidc-scopes list exactly. Before this change, such a deployment would have failed every session open with INTERNAL after the bump. With hosted AS-1, mecak8s now refuses to start if the list lacks offline_access. The operating guide states the requirement.
• Make the tests enforce all three fixes, pinning the exact refusal for each instead of skipping it or accepting any refusal (see Testing).
• Update implementation.md's ToolHive work list. One item stays "Partly": the accepted assertion aud still includes the token-endpoint URL, which #7028 left optional.

Testing

Changes to existing tests:

• TestDelegateCannotObtainAPIAccessTokens now runs. It sends a plain RFC 8693 request for an access token, both with no audience and with audience set to AS-1's. Each gets 400 invalid_request. ToolHive gives this refusal no reason code, so its free-text description, which names the missing output audience, is logged rather than matched. A control subtest shows the same client, assertion and subject token convert with the session-open form, so the refusal comes from the policy. With v0.60.0's configuration the request succeeded.
• TestDelegateRequiresOfflineAccess now runs and expects the reason subject_token_offline_access.
• New TestDelegateRefusesAForeignAudienceSubjectToken: a subject token for another audience AS-1 issues is refused with subject_token_audience. This covers the move from api_audience to subject_token_audiences.
• The reason classification tables in serverrefusal_test.go and sessionopen_test.go include subject_token_offline_access (session open answers INTERNAL).
• TestIdentityBrokerAS1FlagRules has two new cases: --oidc-scopes=openid,profile refuses startup, and --oidc-scopes=openid,offline_access starts.
• TestDelegateRefusesBadAssertions now expects 401 invalid_client in every case: expired, exp more than 5 minutes ahead, wrong audience, unregistered key, and reused jti.

Runs:

• go test -race passes for ./internal/identitybroker/..., ./cmd/mecak8s/, ./internal/adapter/mcpbroker/... and ./internal/adapter/.
• ./internal/app passes with the identity-broker tests selected.
• go vet passes for e2e/k8s (with the kind_e2e tag), environment/microvm and integration/microvm.
• task tidy leaves no changes.
• task lint shows no new findings. It still stops at the existing darwin-only gosec finding in environment/microvm/launch_ownership_darwin.go:754.
• task docs:check is clean.
• CI passes, including the Kind e2e.

API compatibility

No wire change. The one externally visible difference is at AS-1's token endpoint: a token-exchange request from mecatl for an access token is now refused. Mecatl never makes that request.