fix: Cloud Run service-to-service auth and agent card URL

- Add identity token auth in A2ABridgeClient for Cloud Run (K_SERVICE)
- Support CODER_AGENT_PUBLIC_URL env var for agent card URL on Cloud Run
- Strip @Bot mention prefix before slash command detection (Add-ons)
- Grant bridge SA roles/run.invoker on A2A server via IAM

packages/a2a-server/src/http/app.ts

@@ -77,7 +77,11 @@ const coderAgentCard: AgentCard = {
 };
 
 export function updateCoderAgentCardUrl(port: number) {
-  coderAgentCard.url = `http://localhost:${port}/`;
+  // On Cloud Run, use the public service URL so remote clients can reach us
+  const publicUrl = process.env['CODER_AGENT_PUBLIC_URL'];
+  coderAgentCard.url = publicUrl
+    ? publicUrl.replace(/\/$/, '') + '/'
+    : `http://localhost:${port}/`;
 }
 
 async function handleExecuteCommand(