docs: Document AGENT_CONTROL_RUNTIME_TOKEN_HEADER (#42)

## Describe your changes

Added `AGENT_CONTROL_RUNTIME_TOKEN_HEADER` to the **Configuration**
page.

## Jira ticket

https://splunk.atlassian.net/browse/O11YDOCS-8543

## Checklist before requesting a review

- [X] - Is this ready for review? If not, raise as a draft PR
- [X] - This deployed to a staging environment correctly
- [X] - I have reviewed my changes
- [x] - I have reviewed the deployed version of my changes
- [X] - I have tested any code that is added or updated
- [ ] - I have verified all images and videos are clear, with
appropriate zoom
- [ ] - I have verified all images and videos match production (or dev
for unreleased features)
- [ ] - I have tested that the content matches the functionality in
production (or dev for unreleased features)
- [x] - All checks have passed
- [X] - This references a feature that is public. If not, add a note and
we can schedule the merge for after the feature release

Author: sheilattran8

core/configuration.mdx

@@ -10,6 +10,7 @@ icon: "gear"
 |----------|---------|-------------|
 | `AGENT_CONTROL_URL` | `http://localhost:8000` | Server URL |
 | `AGENT_CONTROL_API_KEY` | — | API key for authentication |
+| `AGENT_CONTROL_RUNTIME_TOKEN_HEADER` | `Authorization` | Header used to send runtime tokens. Must match the server setting. |
 
 For server database configuration, use the `AGENT_CONTROL_DB_*` variables in the server section below.
 
@@ -27,6 +28,37 @@ For server database configuration, use the `AGENT_CONTROL_DB_*` variables in the
 | `API_VERSION` | `v1` | API version prefix |
 | `API_PREFIX` | `/api` | API path prefix |
 
+### Runtime Token
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `AGENT_CONTROL_RUNTIME_TOKEN_HEADER` | `Authorization` | Header from which the server reads runtime tokens. Must match the SDK setting. |
+
+By default, the SDK sends the runtime token in the `Authorization` header as `Authorization: Bearer <runtime-token>`.
+
+If a gateway reserves `Authorization` for its own identity credential, configure the server and SDK to use a dedicated header:
+
+```bash
+export AGENT_CONTROL_RUNTIME_TOKEN_HEADER="X-Agent-Control-Runtime-Token"
+```
+
+With this setting, Agent Control SDK 8.5.0 or later sends the runtime token in `X-Agent-Control-Runtime-Token` as a raw token without a `Bearer` prefix. `Authorization` remains available for gateway authentication.
+
+You can alternatively set the header when initializing the SDK:
+
+```python
+agent_control.init(
+    agent_name="my-agent",
+    runtime_token_header="X-Agent-Control-Runtime-Token",
+)
+```
+
+If `runtime_token_header` is not provided, the SDK uses `AGENT_CONTROL_RUNTIME_TOKEN_HEADER`. If neither is configured, it defaults to `Authorization`.
+
+<Note>
+Upgrading to version 8.5.0 or later does not change the default header. A dedicated header is used only after you configure the environment variable or the SDK option.
+</Note>
+
 ### CORS
 
 | Variable | Default | Description |