auth: the lifecycle branch still called hk- a key

Nothing textually conflicted, so the merge could not see this: the branch was
written when hk- was one of the key shapes, and main dropped it from
APIKeyPrefixes in the meantime. isAPIKey("hk-...") is now false, so a validated
caller presenting one falls through credentialClass to session rather than
secret, and TestCredentialClass_ReadsTheCredentialNotTheClient failed on the
one subtest that asserted the old taxonomy.

Main is right and the branch is stale, so the three sites the branch
reintroduced are re-cast the way main re-cast every other one. The fixture is
kept rather than deleted, restated as the negative it now proves: an hk- string
contributes nothing to the classification, so putting hk- back into
APIKeyPrefixes turns this red.

No behaviour changes. Both lanes involved are attributed lanes — secret maps to
agent, session to human — and neither is the bot lane, so nothing is granted or
refused differently. The authentication path is untouched: hk- reaches no key
door and resolves to no principal, which is main's point.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

agency.go

@@ -13,7 +13,7 @@ package cloud
 //
 // FOUR LANES, and the boundary between them is attributability:
 //
-//	agent   — an attributable machine credential (sk-/hk-, or a machine JWT).
+//	agent   — an attributable machine credential (sk-, or a machine JWT).
 //	          Programmatic traffic that a named org pays for and we can switch
 //	          off. This is the lane our own agents run in, and it is the lane a
 //	          customer's automation runs in. It gets judged on VOLUME PATTERN,

agency_test.go

@@ -29,7 +29,11 @@ func TestCredentialClass_ReadsTheCredentialNotTheClient(t *testing.T) {
 		want   string
 	}{
 		{"validated secret key", "acme", "Bearer sk-live-1", "", "curl/8", edge.CredSecret},
-		{"validated hanzo key", "acme", "Bearer hk-live-1", "", "", edge.CredSecret},
+		// hk- is not one of the two key shapes (see APIKeyPrefixes: pk- and sk-).
+		// It reaches no key door and resolves to no principal, so it cannot raise
+		// a caller into the agent lane on its own — whatever else validated this
+		// request, the hk- string contributed nothing to the classification.
+		{"hk- is not a key shape, so it does not classify as one", "acme", "Bearer hk-live-1", "", "", edge.CredSession},
 		{"validated session bearer", "acme", "Bearer eyJhbGciOi.payload.sig", "", "Mozilla/5.0", edge.CredSession},
 		{"publishable key, org resolved", "acme", "Bearer pk-live-1", "", "", edge.CredPublishable},
 		{"publishable key, no org", "", "Bearer pk-live-1", "", "", edge.CredPublishable},

apps/gateway/edge/traffic.go

@@ -215,7 +215,7 @@ const (
 	// CredSession is a validated bearer that is not an opaque key: a browser or
 	// CLI session minted by IAM for a person.
 	CredSession = "session"
-	// CredSecret is an sk-/hk- key: a machine credential issued to a principal.
+	// CredSecret is an sk- key: a machine credential issued to a principal.
 	// It may not be shipped to a browser, so possession attributes.
 	CredSecret = "secret"
 	// CredPublishable is a pk- key: org-only by design, shipped in client