docs: no agent fact exists

The node configuration reference listed agent($id) as the agent the
caller acts for. No code mints or reads such a fact. Only a comment
names it (api/policy_rules.go:135-138). The SDK README listed it among
the authority facts and the injected facts too.

Author: kaisoz

sdk/README.md

@@ -353,8 +353,8 @@ This is how an SDK agent is reached.
 
 A node that serves a tool evaluates the caller's biscuit with an authorizer
 that has, in this order: the biscuit's own authority facts (`node`, `role`,
-`label`, `agent`), injected facts `service(<type>, <name>)`,
-`connection_peer_id(<peer>)`, `time(<now>)` and optionally `agent(<claim>)`,
+`label`), injected facts `service(<type>, <name>)`,
+`connection_peer_id(<peer>)` and `time(<now>)`,
 the baseline checks, rules and policies from `api/datalog.go`, the
 `target_fact` facts derived from the provider's own biscuit, and the mesh
 policy rules. Deny by default.

site/content/docs/reference/node-config.md

@@ -133,7 +133,6 @@ Facts available:
 | `node($id)`, `client_peer_id($id)`, `expiration($t)` | The caller's credential binding and expiry. |
 | `granted_*`, `http_granted_service_*` | The caller's grants. [Datalog vocabulary](../policy/#datalog-vocabulary) lists them. |
 | `target_fact($name, $value)` | This node's own identity facts, for target matching. |
-| `agent($id)` | The agent the caller says it acts for, when present. |
 | `method($m)`, `path($p)` | The request, when it is HTTP: the method as received and the path as the backend sees it. On a tunnel, `CONNECT` and an empty path. Absent on a stream that carries no HTTP request. |
 | `host($h)`, `port($n)` | The destination of a request for an egress destination. |