byot-e2e-validation

# BYOT e2e validation Use this when testing an agent-first app that relies on AWID team certificates. The goal is to prove the relying-party chain works with real keys, real certificates, real signatures, and real AWID facts. ## Iron rule: no mocked auth in e2e No mocked certificates. No mocked signatures. No mocked AWID responses. If you are tempted to mock one of those in e2e, you are about to test nothing. Generate real keys and certificates with `aw id` against a local `awid-service`. Send requests with `aw id request --team-auth`. Unit tests can cover small parsing and interop cases, but the e2e layer must exercise the same cryptographic and registry path a customer uses. ## Harness shape The known-good shape in this repo is `docker-compose.e2e.yml`, `tests/test_e2e_smoke.py`, and the `Makefile` `e2e` target: 1. Docker Compose starts Postgres, Redis, and `awid-service`. 2. `AWID_SKIP_DNS_VERIFY=1` lets tests register disposable `.test` namespaces locally. 3. Each test workspace gets an isolated `HOME` and clean working directory. 4. Provision through the CLI, not fixtures: `aw id create` → `aw id team create` → `aw id team add-member` → `aw id team fetch-cert` → `aw id team switch`. 5. Send the application request with `aw id request --team-auth`; never reimplement signing in test code. Open finding: current `aw id request --team-auth` needs a workspace binding, not only `.aw/teams.yaml` plus `.aw/team-certs/`. The harness writes a minimal `.aw/worksp...