Fix review findings in the act claim audit capture

[jhrozek]

Summary

#6046 landed RFC 8693 act claim capture in audit events. A review of it afterwards surfaced eleven findings, of which the substantive ones were: a config knob that could not do what it advertised, exported test-only API on a production type, a repeated call that six of eight sites could have dropped silently, a published wire contract asserted only as Go struct fields, and three ways the parser lost forensic evidence on malformed input. This fixes all of them.

Closes nothing on its own — this is follow-up on #6035 / #6046.

• maxDelegationDepth above 10 was silently ignored. claimsToIdentity parses at the hardcoded DefaultMaxDelegationDepth and the audit layer could only shrink that result, so an operator setting 25 got 10 actors and no warning while the full chain sat unread in Claims["act"]. Re-parse the raw claim at the configured depth, guarded so it can only widen, never narrow.
• SetLogWriterForTest was exported, immediately deprecated, and needed two //nolint:staticcheck. Config.LogFile already does the job; the integration tests now point it at a t.TempDir() file.
• attachDelegation is hand-repeated in all eight WorkflowAuditor.Log* methods, but only two were tested — the six uncovered ones included every terminal failed/timed-out event. Table-driven over all eight now.
• The emitted wire contract was unpinned. docs/middleware.md publishes delegation_chain.{actors[].sub, actors[].act_claims, truncated, dropped_count}, but most of it was asserted only as Go struct fields, so a struct-tag rename would break every log consumer with a green suite.
• Every nested act chain in the suite was hand-built, so handler.go's act["act"] = priorAct was never executed by a test and the outermost-first ordering the audit record depends on rested on fixtures the tests wrote themselves. A real exchange now drives it via a may_act-bearing subject token (RFC 8693 §4.4, which this server honors but cannot yet issue).
• Parser hardening: a non-string act.sub vanished entirely; a malformed act was indistinguishable from an absent one; act_claims bypassed the internalClaims filter that keeps tsid out of external sinks — which matters because Identity.MarshalJSON redacts tsid from top-level claims but marshals the delegation chain verbatim to webhook receivers.
• maxDelegationDepth had no lower bound while its sibling maxDataSize rejects negatives.

Type of change

• Bug fix (non-breaking change which fixes an issue)

Changes

File	Change
pkg/audit/auditor.go	Re-parse the raw act claim at the configured depth; delete SetLogWriterForTest
pkg/auth/delegation.go	Preserve a non-string sub; add Malformed; filter internalClaims; never emit "actors": null
pkg/auth/context.go	Admit an actorless-but-malformed chain; scope the authz comment to RFC 8693 §4.1
pkg/audit/config.go	Reject a non-positive maxDelegationDepth (Minimum=1 + Validate)
pkg/authserver/server/tokenexchange/{handler,validator}.go	may_act is §4.4, not §4.1 (comments only)
pkg/authserver/integration_delegation_audit_test.go	New: delegation audit tests + helpers, incl. the real multi-actor exchange
docs/middleware.md, docs/arch/02-core-concepts.md	Document malformed, the webhook payload change, and the correct log key
deploy/charts/operator-crds/**, docs/operator/crd-api.md, docs/server/**	Regenerated for Minimum=1

Test plan

• Unit tests
• Manual verification: each fix was mutation-tested — the production behavior was broken, the new test confirmed failing, then restored. Includes dropping attachDelegation from each of the eight Log* methods individually (clean 1:1 failure mapping) and inverting act["act"] = priorAct to confirm the multi-hop ordering assertion bites.

Does this introduce a user-facing change?

Yes, three:

1. delegation_chain gains a malformed member for an act claim that is present but not a JSON object (RFC 8693 §4.1 requires an object).
2. delegation_chain.actors is now always an array — an actorless malformed chain would otherwise have emitted "actors": null, a shape no consumer could see before.
3. maxDelegationDepth above 10 now takes effect; values below 1 are rejected at admission rather than silently becoming 10.

Also worth calling out: PrincipalInfo gained delegation_chain in #6046, so admission webhook receivers already see it. That was undocumented; this PR documents it.

Special notes for reviewers

Overlap with toolhive-core#196. That PR implements the same feature for the shared library and diverges on every JSON key (delegation vs delegationChain, chain vs actors, omitted vs dropped_count), on the default depth (16 vs 10), and on whether per-hop claims are serialized at all. That divergence predates this PR — the field names all landed on main with #6046. Since core#81 graduated the audit package out of toolhive, whichever schema wins there eventually replaces ours, so it needs settling; I have commented on core#196.

The one divergence this PR adds is malformed: core#196 handles the same input by hard-erroring (ErrNotJSONObject) where we record a flag and keep the partial chain. Worth deciding which behavior we want before either is depended on.

Follow-ups filed rather than folded in: #6093 (the auth server can itself mint a §4.1-violating nested act, which is how malformed becomes reachable from our own issuance path), #6094 (WorkflowAuditor leaks the audit log fd), #6095 (extract the eight-way repeated event prologue — the root cause the new test table only guards against).

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.35%. Comparing base (92c70db) to head (fdaa9a8).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6096      +/-   ##
==========================================
+ Coverage   72.31%   72.35%   +0.04%     
==========================================
  Files         730      731       +1     
  Lines       75630    75759     +129     
==========================================
+ Hits        54689    54813     +124     
- Misses      17035    17045      +10     
+ Partials     3906     3901       -5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.