feat: agent sample with bearer authed tool call

[tore-archastro]

Adds an Internal Caller Agent sample that demonstrates how an ArchAgents agent can make an authenticated outbound HTTP request using an agent-scoped bearer token. The sample includes an AgentTemplate, a script-backed get_auth_status custom tool, an env.example for AGENT_BEARER_TOKEN, and README instructions for deploying the sample and testing it against httpbin.org/bearer.

The script reads the bearer token from the agent-scoped environment variable, sends it in the Authorization header, and returns a safe auth summary without exposing the token value. The sample catalog and agents README are updated so the demo is visible alongside the other public sample agents.

Sample run

  archagent create agentsession \
    --agent agi_033OiY5csrps167S2jKT1Q \
    --instructions 'Call get_auth_status once and report the result.' \
    --wait
Agent session created: ase_033OibNASkY17hThBKoEiv [pending]
Here's a summary of the result:

| Field | Value |
|---|---|
| **Authenticated** | ✅ `true` |
| **HTTP Status** | `200 OK` |
| **Endpoint** | `https://httpbin.org/bearer` |
| **Token Source** | Agent-scoped env var: `AGENT_BEARER_TOKEN` |
| **Token Preview** | `demo_7b8cd...` |
| **Token Matched Secret** | ✅ `true` |

**Conclusion:** httpbin **accepted** the bearer token. The request was fully authenticated — the token was pulled from the agent-scoped `AGENT_BEARER_TOKEN` environment variable, sent as a Bearer token in the `Authorization` header, and httpbin confirmed it as valid with a `200 OK` response.

Session completed.

[archastro]

✅ Nice work, @tore-archastro! No blocking findings on 41273f0 — a couple of moves worth calling out:

• Followed bearer-token-script-returns-booleans-not-raw-token cleanly — get-auth-status.aascript returns only boolean flags and never the raw token value, while agent.yaml identity gates the LLM from surfacing it. 🎯
• Followed env-example-placeholder-pem-not-real-credential correctly — AGENT_BEARER_TOKEN=demo_replace_with_random_token is an unambiguous placeholder with a comment explaining it's intentionally agent-scoped.

---

_{Reply @archastro <verb>: review · do <pattern> · don't <pattern> · forget <slug> · list}