Deliver completed session reports to the gateway

[areshand]

Summary

• issue a session-scoped worker token through the Kubernetes bootstrap Secret
• retry authenticated final-report delivery to a deployment-provided gateway endpoint before the worker exits
• persist the report at the gateway before projecting the assistant event and finalizing the thread session
• retry transient public GET failures in the durable-thread E2E harness
• document the generic handoff boundary; multiagent remains unaware of S3 and provider credentials

Production finding

The two-session GitHub E2E produced correct oracle-matching reports through prod-mcp. During a gateway outage, session B completed and exported its report to S3, but the gateway had not cached it before the ephemeral worker exited, leaving the public thread running without the result. This PR closes that handoff gap.

Validation

• npm test: 19 passed
• node --check src/server.mjs
• node --check test/github-thread-resume.e2e.mjs
• git diff --check

External rerun blocker

A fresh production rerun currently fails before agent work because the Anthropic account reports its usage limit is exhausted until 2026-09-01T00:00Z.