fix(forge): use an agent-bound token for the benchmark agent and fail on auth rejection

[JLCode-tech]

• What changed: Replaced operator JWT authentication for benchmark agent WebSockets and result ingestion with an agent-bound token lifecycle. Added agent token resolution precedence (CLI flag --forge-agent-token, AWSBNKCTL_FORGE_AGENT_TOKEN, cluster.yaml forge.agent_token, 0600 cached token file forge_agent_token.json, and operator minting via POST /api/benchmarks/agents/{id}/token). Configured WebSocket dial to pass bearer token in query parameter and Authorization header. Added fatal non-zero termination on authentication failure (WebSocket close 4401, HTTP 401/403) with one-time cache invalidation and re-minting for stale cached tokens. Updated documentation in docs/FORGE_INTEGRATION.md and docs/COMMANDS.md.
• Forge contract it relies on: Forge agent WebSockets (/ws/benchmarks/agents/{agent_id}) require a bearer JWT containing role agent and an agent_id claim matching the URL path ID; operator/admin JWTs lack this claim and are closed with code 4401. Token minting endpoint POST /api/benchmarks/agents/{agent_id}/token is available on Forge >= 2.11; older Forge builds returning HTTP 404/405 produce an actionable error requiring explicit token configuration.
• How to verify: Run go test ./... including targeted unit tests TestBenchmarkAgentWorker_FatalAuthClose4401, TestBenchmarkAgentWorker_CachedTokenRejection_RemintsAndReconnects, and TestBenchmarkDaemon_EndToEndMock. Validate manual check against Forge without mint endpoint: awsbnkctl benchmark daemon --forge-rest-url <url> --forge-user admin --forge-pass <pw> exits non-zero immediately with the Forge >= 2.11 guidance message without looping.