feat(authbridge): add sparc plugin integration to the pipeline

[vz-ibm]

What this adds

Wires the AuthBridge sparc plugin into this harness's pipeline
composition, so deploy-agent.sh --plugin-preset sparc-only works:

• authbridge/plugins/sparc.yaml — plugin fragment (reflector endpoint,
  enforcement mode, track, timeout).
• authbridge/presets/sparc-only.yaml — SPARC guardrails without inbound
  auth (for an upstream gateway that's already terminated auth, or direct
  calls without a JWT). Outbound: inference-parser, mcp-parser,
  sparc.
• sparc-deny.yaml / sparc-observe.yaml — enforcement-mode overlays for
  --plugin-config-file.
• deploy-agent.sh — resolves --plugin-preset sparc-only into the
  pipeline selector list; sets SPARC_REFLECTOR_ENDPOINT default to the
  in-cluster sparc-service (namespace-correct for rossoctl-system,
  not the historical kagenti-system).

Two follow-up fixes bundled in because they were needed for the plugin to
actually work as deployed, not just resolve:

• Removed strip_tool_args from sparc.yaml — that config key requires a
  custom AuthBridge build not yet available upstream; removed until it
  ships (see rossoctl/cortex#738
  for the sparc-service-side equivalent, which doesn't need an AuthBridge
  rebuild).
• Set on_reject_action: observe (was reflect) for the initial rollout
  phase — evaluates every call and logs a verdict without blocking
  anything, so behavior doesn't change while the pipeline is verified
  end-to-end.

Verification

Ran on a live rossoctl Kind cluster: deploy-agent.sh --plugin-preset sparc-only resolves to a2a-parser mcp-parser inference-parser sparc,
the AuthBridge sidecar logs reloader: pipelines swapped, and a live Tau2
benchmark run against the SPARC-enabled agent shows the sparc plugin
correctly intercepting real WRITE tool calls and getting genuine
LLM-backed decisions from sparc-service (decision=approve score=1.00).

Requires an AuthBridge sidecar image with the sparc plugin compiled in
— see rossoctl/cortex#736
(merged) for a real bug that silently excluded it from every published
image tag.