[Story] Trust bundle distribution (connected + air-gapped modes)

[shreyanshjain7174]

Parent

Part of #146 (Cross-Cluster Agent Identity Federation epic).

Status

Blocked by validation gate. Depends on SPIRE topology design.

Goal

Implement two trust-bundle distribution modes — connected (automatic via SPIFFE Federation API) and air-gapped (manual bundle export/import).

Scope

• Connected mode:
  • Operator reads spec.identity.spiffe.federatedTo and configures SPIRE federation relationships via SPIRE Federation API
  • Periodic refresh (default 30s)
  • Status surfaced on AgentWorkload.status.identity.federationState
• Air-gapped mode:
  • CLI: agentctl identity export-bundle --trust-domain X --out bundle.json
  • CLI: agentctl identity import-bundle --from bundle.json
  • Document manual transfer recipe (USB, mTLS jumphost, etc.)
• Helm values: identity.spiffe.federation.mode = connected | air-gapped
• Bundle rotation: validate signatures, reject expired bundles

Reference

RFC-0001 § 4.5

Acceptance

• Both modes covered by end-to-end test scenarios
• CLI commands documented in docs/agentctl/identity.md