Rename the supply agent everywhere it is named

Its Keycloak client, audience scope, client-secret key, workflow names and file
names, and the A2A card. Kafka moved first, under its own account and consumer
group.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/agents/ingress.yaml

@@ -4,7 +4,7 @@
 # every conversation with it went through `kubectl run curl`. An orchestrator
 # nobody can talk to is not finished.
 #
-# Peer traffic does **not** come through here — approvisionnement calls, and is called by,
+# Peer traffic does **not** come through here — supply calls, and is called by,
 # other agents on their in-cluster Service names. This is the human door.
 #
 # ## It is not an open door