DL-516

The bundled gateway’s llm-gateway service bearer is <state>/gateway/service.token; agents are admitted only through VerifyAgentToken, and the optional enroll token admits only the enroll caller on /internal/enroll/* (OQ2: no inbound shared bearer)

Status: Active (Matt, 2026-10-12)