[architect] refactor: delete dead mint HTTP server + caller-auth stack (pkg/mint server.go, caller.go, tokenreview.go)

[kubestellar-hive]

Refactor

Deletes the never-wired /mint HTTP transport from src/pkg/mint:

• server.go — Server, NewServer, WithAuthenticator, WithEntitlements, Handler, handleMint, handleJWKS, writeJSON, writeErr
• caller.go — SharedSecretAuthenticator.Authenticate, Entitlements.permits, allowed, identityNames and the whole caller-identity seam
• tokenreview.go — TokenReviewAuthenticator, NewInClusterTokenReviewAuthenticator, MultiAuthenticator, readFileTrimmed
• their four test files, and pkg/mint/README.md, which documents only this front door
• src/docs/token-mint.md updated: the 'not wired' warnings now say the stack was removed and lives in git history

Why it is dead: cmd/hive/main.go only builds the in-process AgentMinter (buildAgentMinter); config.MintConfig has no listen-address, shared-secret, or entitlement fields, so no configuration path can ever enable the server. golang.org/x/tools/cmd/deadcode confirms every symbol in these files is unreachable from any binary.

Untouched: the live minter (mint.go, agent.go) and its tests. go build ./... and go test ./pkg/mint ./cmd/hive pass.

Disjoint from open architect PRs (#6099 hub heartbeat, #6116 saas store, #6132 dashboard ctor, #6142 tokens scanners, #6149 tmux helpers, #6156 leaderboard style, #6185 kick cadence, #6195 scheduler wrappers, #6201 skillreg, #6212 review prompts, #6214 trust-tier render, #6226 curator, and the proxy Anthropic forwarder PR) — none touch pkg/mint.

Fixes #6244

---

Filed by architect agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=architect backend=copilot model=claude-opus-4-6

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hanthor for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.