REMOTE-1601 Add named agent API key support behind FeatureFlag::NamedAgents (#10390)

## Description
Add support for creating API keys scoped to named agent identities in
the Oz Cloud API Keys settings page, gated behind
`FeatureFlag::NamedAgents` (dogfood-enabled).

When the flag is enabled, the "Team" option in the key-type selector is
replaced with "Agent". Users can select which named agent the key
authenticates as from a dropdown populated via `GET
/api/v1/agent/identities`. If no agents exist, an empty state links to
`oz.warp.dev/agents` to create one.


### Changes
- **`crates/warp_features`**: Add `FeatureFlag::NamedAgents` to dogfood
- **`crates/warp_graphql_schema`** + **`crates/graphql`**: Add
`agentUid: ID` to `GenerateApiKeyInput`
- **`app/src/server/server_api/auth.rs`**: Add `AgentIdentity` type,
`list_agent_identities()`, and `agent_uid` param to `create_api_key()`
- **`app/src/settings_view/platform/create_api_key_modal.rs`**: Agent
type selector, dropdown, empty state, create flow
- **`app/src/settings_view/platform_page.rs`**: Scope column displays
"Agent" when flag is on

[Oz
conversation](https://staging.warp.dev/conversation/d5027d88-07f2-482e-a2eb-39879d66fc9e)
· [Plan](https://staging.warp.dev/drive/notebook/OC5WmSrFQZwF9BAYEhWMM6)

## Linked Issue
- [ ] The linked issue is labeled `ready-to-spec` or
`ready-to-implement`.
- [x] Where appropriate, screenshots or a short video of the
implementation are included below (especially for user-visible or UI
changes).
https://www.loom.com/share/636237a795c34e1ca1806761b5018160

## Testing
Feature is behind `FeatureFlag::NamedAgents` (dogfood only). Verified
compilation of `warp_features` and `warp_graphql` crates. Full app
compilation blocked by pre-existing `http_client` error unrelated to
this change.

## Agent Mode
- [x] Warp Agent Mode - This PR was created via Warp's AI Agent Mode

Co-Authored-By: Oz <oz-agent@warp.dev>

---------

Co-authored-by: Oz <oz-agent@warp.dev>

Author: jasonkeung

app/src/ai/agent_sdk/driver/git_credentials.rs

@@ -241,7 +241,7 @@ pub(crate) fn configure_git_identity(credentials: &[GitCredential]) {
 /// API call fails — these are transient failures worth retrying.
 async fn try_refresh(task_id: &str, ai_client: &Arc<dyn AIClient>) -> Result<()> {
     let workload_token =
-        warp_isolation_platform::issue_workload_token(Some(Duration::from_mins(5)))
+        warp_isolation_platform::issue_workload_token(Some(Duration::from_secs(5 * 60)))
             .await
             .context("Failed to issue workload token for git credentials refresh")?
             .token;

app/src/ai/agent_sdk/mod.rs

@@ -1031,7 +1031,7 @@ impl AgentDriverRunner {
                 return Ok(vec![]);
             }
             let workload_token = match warp_isolation_platform::issue_workload_token(Some(
-                std::time::Duration::from_mins(5),
+                std::time::Duration::from_secs(5 * 60),
             ))
             .await
             {

app/src/server/server_api/auth.rs

@@ -66,6 +66,20 @@ use crate::{
 
 use super::ServerApi;
 
+/// A named agent identity from the public API.
+#[derive(Clone, Debug, serde::Deserialize)]
+pub struct AgentIdentity {
+    pub uid: String,
+    pub name: String,
+    pub available: bool,
+}
+
+/// Wrapper for the `GET /api/v1/agent/identities` response.
+#[derive(serde::Deserialize)]
+struct AgentIdentitiesResponse {
+    agents: Vec<AgentIdentity>,
+}
+
 /// Error messages returned from the Firebase REST API when attempting to convert a refresh token
 /// into an access token that indicate the user's token is in an errored state.
 /// These are "soft" errors because the user likely just needs to log in again.
@@ -201,11 +215,15 @@ pub trait AuthClient: 'static + Send + Sync {
         &self,
         name: String,
         team_id: Option<cynic::Id>,
+        agent_uid: Option<cynic::Id>,
         expires_at: Option<warp_graphql::scalars::Time>,
     ) -> Result<GenerateApiKeyResult>;
 
     async fn expire_api_key(&self, key_uid: &ApiKeyUid) -> Result<ExpireApiKeyResult>;
 
+    /// Fetches the list of named agent identities for the user's team.
+    async fn list_agent_identities(&self) -> Result<Vec<AgentIdentity>>;
+
     /// Returns a cached ambient workload token, or issues a new one if not present or expired.
     ///
     /// Returns `Ok(None)` if not running in an isolation platform (e.g., Namespace) or on WASM.
@@ -606,12 +624,14 @@ impl AuthClient for ServerApi {
         &self,
         name: String,
         team_id: Option<cynic::Id>,
+        agent_uid: Option<cynic::Id>,
         expires_at: Option<warp_graphql::scalars::Time>,
     ) -> Result<GenerateApiKeyResult> {
         let variables = GenerateApiKeyVariables {
             input: GenerateApiKeyInput {
                 name,
                 team_id,
+                agent_uid,
                 expires_at,
             },
             request_context: get_request_context(),
@@ -620,6 +640,12 @@ impl AuthClient for ServerApi {
         let response = self.send_graphql_request(operation, None).await?;
         Ok(response.generate_api_key)
     }
+
+    async fn list_agent_identities(&self) -> Result<Vec<AgentIdentity>> {
+        let response: AgentIdentitiesResponse = self.get_public_api("agent/identities").await?;
+        Ok(response.agents)
+    }
+
     async fn expire_api_key(&self, key_uid: &ApiKeyUid) -> Result<ExpireApiKeyResult> {
         let variables = ExpireApiKeyVariables {
             key_uid: key_uid.into(),