Rename the supply agent everywhere it is named

Its Keycloak client, audience scope, client-secret key, workflow names and file
names, and the A2A card. Kafka moved first, under its own account and consumer
group.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/agent-secrets.yaml

@@ -18,7 +18,7 @@ spec:
   target:
     name: n8n-agent-secrets
   data:
-    - secretKey: APPROVISIONNEMENT_CLIENT_SECRET
+    - secretKey: SUPPLY_CLIENT_SECRET
       remoteRef:
         key: keycloak/classic-models-realm
-        property: KC_SECRET_CLASSIC_MODELS_AGENT_APPROVISIONNEMENT
+        property: KC_SECRET_CLASSIC_MODELS_AGENT_SUPPLY

deploy/agents/ingress.yaml

@@ -4,7 +4,7 @@
 # every conversation with it went through `kubectl run curl`. An orchestrator
 # nobody can talk to is not finished.
 #
-# Peer traffic does **not** come through here — approvisionnement calls, and is called by,
+# Peer traffic does **not** come through here — supply calls, and is called by,
 # other agents on their in-cluster Service names. This is the human door.
 #
 # ## It is not an open door

deploy/agents/supply.yaml

@@ -1,4 +1,4 @@
-# The A2A facade for Approvisionnement. It lives in the `agents` namespace with
+# The A2A facade for Supply. It lives in the `agents` namespace with
 # the other agents, not with n8n: what it is, is an agent — the workflow behind
 # it is an implementation detail its callers never see.
 apiVersion: apps/v1
@@ -31,7 +31,7 @@ spec:
               containerPort: 8080
           env:
             - name: ADAPTER_AGENT_NAME
-              value: approvisionnement
+              value: supply
             - name: ADAPTER_AGENT_DESCRIPTION
               value: >-
                 Supply decisions for the Classic Models catalog. Answers whether a