MCP bridge, OIDC auth, workflow templates, and matriarch remediation

[bryanbarton525]

Summary

• Matriarch remediation: Pod remediation can run when Matriarch blocks on validation (existing branch commit).
• MCP bridge (mcp-orca): New MCP server proxies workflow tools (orca_workflow_*) and ad-hoc persona tools (orca_persona_run, orca_task_run) to go-orca-api; Docker image and CI build entry added.
• OIDC API auth: server.oidc userinfo validation (Zitadel / Authentik) on protected /api/v1 routes; health/readiness/metrics stay public; shared Bearer middleware with legacy streaming.userinfo_url fallback for event ingest.
• Workflow templates: Embedded YAML catalog (software-default, content-default, etc.), GET /workflow-templates, template_id on workflow create.
• Persona runs: POST /api/v1/persona-runs for one-shot persona execution (engine RunPersonaOnce).
• Docs & skill: Deployment/configuration/streaming docs and skills/go-orca-offload for Cursor offload with OIDC Bearer tokens.

Test plan

• go test ./...
• go build ./cmd/go-orca-api ./cmd/mcp-orca
• With server.oidc.required: true, verify unauthenticated API calls return 401 and valid Zitadel/Authentik Bearer succeeds
• Deploy mcp-orca, call orca_workflow_create and orca_persona_run from an MCP client with tenant/scope headers
• GET /api/v1/workflow-templates returns catalog; create workflow with template_id: software-default
• Confirm matriarch-blocked validation workflows still enqueue pod remediation tasks

Made with Cursor