Krate Identity Engine overview

Handles OIDC/OAuth sign-in, maps external identities to Kubernetes users and groups via IdentityMapping CRDs, and evaluates Kubernetes RBAC policy for every API call. Issues scoped ServiceAccount tokens for CI jobs and agent dispatch attempts. Manages User, Team, Invite, AuthProvider, AgentServiceAccount, and AgentRoleBinding resources to ensure the forge never creates a parallel permission system.