P4: Agent-Identitäten ohne Secrets — sanitized config feed

- Replace Python-based sanitizer in deploy script with lightweight jq/alpine
- Add sync-agents-sanitized.mjs for on-demand and watch-mode sync
- Add AgentConfigPath to appsettings.json (explicit default)
- Extend /health/live endpoint to report agent count from sanitized config
- Document architecture in docs/agent-identity-architecture.md
- No openclaw.json secrets ever reach Nexus API containers

Verification:
- curl /api/v1/agents → 9 agents, zero secrets in response
- agents-sanitized.json contains only 'agents' key, no gateway/auth
- All C# code paths read from agents-sanitized.json (AgentConfigPath)
- Bridge controller resolves agent IDs via AgentService.GetAllowedAgentIdsAsync()

.gitea/scripts/deploy-nexus.sh

@@ -111,29 +111,25 @@ AGENTS_SANITIZED_PATH="/home/projekte_bao/openclaw/data/openclaw/agents-sanitize
 OPENCLAW_CONFIG="/home/projekte_bao/openclaw/data/openclaw/openclaw.json"
 OPENCLAW_CONFIG_DIR="/home/projekte_bao/openclaw/data/openclaw"
 
-# Use Docker to read openclaw.json (runner doesn't have direct host fs access)
+# Extract only "agents" key from openclaw.json using jq in an alpine container.
+# This ensures NO secrets (gateway, channels, auth, etc.) leak into the sanitized file.
 if docker run --rm \
   -v "$OPENCLAW_CONFIG:/input/openclaw.json:ro" \
   -v "$OPENCLAW_CONFIG_DIR:/output" \
-  python:3.12-alpine \
-  python3 -c "
-import json, sys, os
-config_path = '/input/openclaw.json'
-output_path = '/output/agents-sanitized.json'
-if not os.path.isfile(config_path):
-    print(f'WARNING: openclaw.json not found at {config_path} — agents-sanitized.json NOT generated', file=sys.stderr)
-    sys.exit(1)
-with open(config_path) as f:
-    data = json.load(f)
-agents = data.get('agents')
-if agents is None:
-    print('ERROR: \"agents\" key not found in openclaw.json', file=sys.stderr)
-    sys.exit(1)
-with open(output_path, 'w') as f:
-    json.dump({'agents': agents}, f, indent=2)
-    f.write('\n')
-print(f'Sanitized agents config written ({len(agents.get(\"list\", []))} agents)')
-" 2>&1; then
+  alpine:3.20 \
+  sh -c '
+    if ! apk add --no-cache jq >/dev/null 2>&1; then
+      echo "WARNING: jq not available, agents-sanitized.json NOT regenerated" >&2
+      exit 1
+    fi
+    if [ ! -f /input/openclaw.json ]; then
+      echo "WARNING: openclaw.json not found — agents-sanitized.json NOT regenerated" >&2
+      exit 1
+    fi
+    jq "{agents: .agents}" /input/openclaw.json > /output/agents-sanitized.json
+    count=$(jq ".agents.list | length" /output/agents-sanitized.json 2>/dev/null || echo 0)
+    echo "Sanitized agents config written ($count agents)"
+  ' 2>&1; then
   echo "Sanitized agents config written to $AGENTS_SANITIZED_PATH"
 else
   echo "WARNING: Failed to generate agents-sanitized.json — Nexus will use fallback agent IDs" >&2