[amctl] Phase 0 — CLI foundation, conventions & release pipeline

[jhivandb]

Login and instance registration as a single action: an instance is its URL, and the token is valid only against that URL. Plus the server-side discovery the client relies on to find its authorization server.

Delivered

• Browser login — amctl login OAuth2 PKCE authorization-code flow for interactive use.
• Headless login — amctl login --client-id --client-secret client-credentials flow for CI/automation.
• Server-side discovery — GET /.well-known/oauth-protected-resource (RFC 9728) and a WWW-Authenticate: Bearer challenge with a resource_metadata pointer on 401 (RFC 6750); SERVER_PUBLIC_URL / OAUTH_AUTHORIZATION_SERVERS config with startup validation. Used by both amctl and the MCP server.
• Default endpoint — amctl login defaults to the Agent Platform SaaS URL when --url is omitted; explicit --url still targets any instance (incl. http://localhost:9000).

PRs

• Add amctl CLI for managing agents from the terminal #753 — Add amctl CLI (login: PKCE + client-credentials)
• Add RFC 9728 OAuth 2.0 Protected Resource Metadata #773 — Add RFC 9728 OAuth 2.0 Protected Resource Metadata
• Default amctl login to production URL #994 — Default amctl login to production URL (open)

Status

Done; #994 in review.

Part of the Agent Manager CLI epic.