fix(translator): honour a BYO harness's configured PORT so the card and runtime agree

[wangzhengzhuo05]

What

The byo harness compiler advertised the agent card at http://127.0.0.1:80 while injecting no PORT, so a BYO image built with go/adk/pkg/app listened on its 8080 default, reported READY, and then failed every invoke.

The port is now taken from the harness's own configuration: whatever PORT the harness sets in spec.env is what both the runtime receives and the card advertises. PORT=80 is only injected when the harness configures no usable port.

Why

go/core/internal/translator/byo/compiler.go built the card with a hard-coded http://127.0.0.1:80, but its environment was only compiled.Environment plus adkconfig.HarnessEnvironment(harness). go/adk/pkg/app resolves the listen port as cfg.Port -> PORT env -> default 8080, so the card and the runtime disagreed. Readiness is probed on :8081 independently of PORT, so nothing surfaced the mismatch and the instance stayed READY while unreachable.

BYO is an opaque harness, so the compiler must not force a port it cannot know (review feedback on this PR). At the same time the card and the runtime must not be able to disagree, so the advertised port is derived from the environment that is actually rendered.

How

• Build the environment as adkconfig.DedupeEnv(compiled.Environment + HarnessEnvironment(harness)).
• configuredPort reads the last PORT entry in that environment (the same last-wins semantics DedupeEnv uses). A value in 1..65535 is the harness's port, and nothing is injected.
• Otherwise the default 80 is appended, matching the built-in kagent compiler for an unconfigured BYO harness.
• agentTemplateCard now takes the resolved port and builds http://127.0.0.1:<port>.
• Environment is resolved before BuildProvenance so the provenance hashes the same environment that ships.

No API or CRD change.

Tests

• TestCompilePortResolution covers: no PORT -> exactly one PORT=80 and card http://127.0.0.1:80; spec.env PORT=8080 -> exactly one PORT=8080 and card http://127.0.0.1:8080; PORT=banana -> falls back to exactly one PORT=80 and card http://127.0.0.1:80.
• TestCompileOpaqueImage unchanged in intent.
• cd go && go test ./core/internal/translator/byo/... passes; cd go && go build ./... passes; gofmt -l clean.
• Mutation check: pinning configuredPort to always report "not configured" makes the PORT=8080 case fail, so the regression test guards the behaviour rather than the implementation.

This change was implemented with AI assistance (OpenCode + muse-spark 1.3) and reviewed and verified locally; I understand it and take responsibility for it.

Fixes #2758

Mistake

[EItanya]

I approved this, but actually I realized that I'm not sure it makes sense. BYO is meant to be opaque harness, so I'm not sure we should auto inject that variable, maybe the user can do it via config?

[wangzhengzhuo05]

Thanks for the review — agreed, and reworked.

BYO is opaque, so the harness's own configuration now wins:

• a PORT set in spec.env is honoured verbatim — nothing is injected, and the card advertises http://127.0.0.1:<that port>, so the card and the runtime cannot disagree;
• PORT=80 is only injected when the harness configures no usable port, which keeps the unconfigured BYO case from byo harness injects no PORT but advertises the agent on :80, so a BYO image built with go/adk/pkg/app is READY and unreachable #2758 working out of the box and matches what the built-in kagent compiler already does.

Covered by TestCompilePortResolution:

• no PORT -> injected PORT=80, card :80
• PORT=8080 in spec.env -> single PORT=8080, card :8080 (the case you flagged)
• PORT=banana -> falls back to PORT=80, card :80

go test ./core/internal/translator/byo/... and go build ./... are green, and the PORT=8080 case fails if the resolution is stubbed out. No API or CRD change.

[EItanya]

Sorry for changing my mind here, but I actually think that this requires an API change. Part of any BYO harness integration is the port on which they serve A2A. Therefore I think that port should be a setting in the BYO section of Harness. What do you think? That would also allow us to avoid reading the PORT env in the comiler

[moezdil]

credentialref port falls through to the 80 default here?

[wangzhengzhuo05]

Thanks for the second look — and no worries at all about changing your mind, I think you're right.

If the A2A port is part of what defines a BYO harness integration, then it belongs in the Harness spec as an explicit field, and the translator/compiler should stop inferring it from PORT in the environment. That is a different change from what this PR does, so it does not make sense to keep this sitting in your review queue while that design question is open.

Closing it. For the record, what this branch contained (in case any of it is worth folding into the API-shaped version): it made the inference path and the rendered card agree on a single port — a PORT set in spec.env was honoured verbatim and the card advertised exactly that port, with PORT=80 injected only when nothing was configured — plus a regression test covering the three cases (configured port, unconfigured, non-default). The underlying complaint from #2758 was really that the card and the runtime could advertise different ports, which the port field in the BYO section would also solve, just more honestly.

Thanks for the careful review — the push-back was the most useful part of this thread.