feat(agentkit): pass Runtime identity through VeADK helper - #794

Summary

Adds optional Runtime identity passthrough from VeADK create_agentkit_app to AgentkitAgentServerApp.

• Ordinary VeADK usage remains compatible with agentkit-sdk-python>=0.8.0; existing users are not forced to upgrade.
• Runtime identity is opt-in. Only callers that pass identity= need an AgentKit SDK exposing the Runtime identity contract (planned for 0.8.2+).
• When identity is requested with an older AgentKit SDK, VeADK fails closed with a clear upgrade error instead of silently running without the identity boundary.
• Scope is AgentKit/VeADK only — this does not reuse or imply an ArkClaw implementation.
• Upstream implementation: feat(identity): add verified Runtime OBO SDK agentkit-sdk-python#160 is merged.

Compatibility and release semantics

This VeADK PR no longer globally depends on AgentKit 0.8.2 and does not make the 0.8.2 release a merge blocker.

The AgentKit 0.8.2 package/tag is needed only before users can install and use the new Runtime identity capability through the standard package channel. Users who do not enable Runtime identity can continue using their existing compatible AgentKit SDK.

Validation

• VeADK AgentKit integration suite: 34 passed
• Legacy AgentKit compatibility validated with a real 0.6.2 checkout:
  • creating the app without identity succeeds
  • passing identity fails with the expected actionable error
• Ruff format/check passed
• git diff --check passed
• uv lock --check --offline passed; no lock refresh required

Security boundary

VeADK only passes the identity object through after verifying that the installed AgentKit server supports the required contract. It does not store raw user tokens, exchange tokens, or expose credentials to Agent/Tool code. Identity-enabled startup fails closed when the enforcement capability is unavailable.