CP-25864: fall back cluster_name to cyberark.service_id under Conjur JWT

[roeezis]

Summary

• MachineHub cluster_name fallback chain (cluster_name -> cluster_id -> ARK_USERNAME -> empty) always resolves empty for Conjur JWT installs: the disco-agent chart never sets cluster_id, and ARK_USERNAME doesn't exist under JWT auth.
• Adds cyberark.service_id (the Conjur authn-jwt service ID, always set by the CyberArk onboarding wizard) as a final fallback before empty.
• Combined with the existing config-validation gate (requires service_id or ARK_USERNAME+ARK_SECRET), an empty ClusterName is now unreachable for any MachineHub config that passes validation.

Test plan

• go test ./pkg/agent/... (excluding the pre-existing envtest-gated Test_ValidateAndCombineConfig_VenafiConnection, unrelated to this change)
• Updated 2 existing tests whose expected behavior changed, added 1 new fallback test, removed 1 now-unreachable "empty" case with explanatory comment

🤖 Generated with Claude Code

[roeezis]

All threads resolved, checks green. Let me know if there's anything else you'd like changed before approving — happy to address further.

[wallrj-cyberark]

Approving. The fallback logic is correctly placed, the behaviour is now covered by a test that asserts the validation gate rather than the absence of a value, and the two questions I could not settle from this repository have been answered with evidence from the systems concerned. Thank you for chasing both down rather than waving them through.

Verified locally at 62a26ad: go build ./... is clean and all fourteen subtests of TestConfig_CyberArk_Validation pass. The only failures are the pre-existing KUBEBUILDER_ASSETS envtests, which fail identically on master and are called out in the description.

One documentation point remains, and I am explicitly not blocking on it. README.md:100 is still headed "Per-tenant Conjur onboarding" and the deploy snippet at README.md:125 still passes --set config.cyberark.serviceId=disco-agent, which is the same shared literal removed from the generated comment in 62a26ad for not being unique. As it stands the file asks an operator to paste a fixed value in one place and warns that the value must be cluster-unique in another. Worth correcting the heading, the "tenant must be onboarded" sentence and the literal in the snippet, either before merge or as a follow-up — your call.

The backend overwrite behaviour discussed in the second thread is a pre-existing gap affecting every client, not something this change introduces, and is better tracked separately as you suggested.

[roeezis]

Fixed in c876edf — retitled to "Per-cluster Conjur onboarding", corrected the onboarding sentence, and replaced the shared disco-agent literal in the worked example with a placeholder $SERVICE_ID variable, with a note that it's cluster-specific.