[codex] identity/v1: add agent_id to IssueAgentTokenRequest

[haasonsaas]

Summary

• add agent_id to identity.v1.IssueAgentTokenRequest
• mark caller-supplied agent_type and capabilities as deprecated instead of removing them outright
• regenerate the Go, TypeScript, and Python protobuf artifacts for the updated request contract

Why

evalops/identity#70 needs IssueAgentToken to validate an existing agent record in registry and derive agent_type plus capabilities from that record. The current proto request cannot express that because it does not carry an agent identifier.

Adding agent_id as a new field keeps wire compatibility while allowing identity to enforce the registry-backed lookup.

Validation

• buf generate
• npm run check:package

Related: evalops/identity#70

[cursor]

PR Summary

Medium Risk
Updates the agent token issuance request contract; consumers must adopt agent_id (or keep relying on deprecated fields), and mismatched client/server versions could cause token issuance failures.

Overview
Adds a new agent_id field to identity.v1.IssueAgentTokenRequest so callers can reference an existing agent record, with documented precedence over caller-supplied agent_type/capabilities.

Marks agent_type and capabilities as deprecated (retained for backward compatibility) and regenerates the Go, Python, and TypeScript protobuf artifacts to reflect the updated contract (including deprecation metadata and a new accessor/field).

^{Reviewed by Cursor Bugbot for commit a42cda9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[haasonsaas]

Review

This is the right direction — IssueAgentToken should validate against a known agent record rather than trusting caller-provided metadata.

Looks good

• Adding agent_id as a new field preserves wire compatibility
• Deprecating agent_type and capabilities (rather than removing) gives consumers time to migrate
• Aligns with the identity→registry bridge work (identity#73)

Question

What happens when both agent_id AND deprecated agent_type/capabilities are provided? The identity service should:

1. If agent_id is set: look up the registry record, ignore deprecated fields
2. If agent_id is empty but deprecated fields are set: use them (backward compat)
3. If nothing is set: reject

This precedence should be documented in the proto field comments so all implementations agree.