feat(cli): add agentkit list sessions --harness <name>

[yaozheng-fang]

What

Adds agentkit list sessions --harness <name> — lists a user's conversation sessions on a deployed harness runtime, by calling the runtime's ADK data-plane endpoint:

GET {harness_url}/apps/harness/users/{user_id}/sessions

user_id resolution

ADK's list endpoint takes user_id as a required path param (no cross-user listing), so user_id must be determinable:

1. explicit --user-id <id>;
2. otherwise the JWT sub of the harness credential — a custom_jwt harness uses the agentkit login id_token (or -ak), whose sub is the user;
3. a key_auth harness's key is an opaque api key (not a JWT) → fast-fail asking for --user-id.

Harness addressing mirrors invoke harness (resolved from the harness.json registry, harness credential for auth) — a data-plane call, distinct from the control-plane list harness (AK/SK ListRuntimes).

Changes

• agentkit/toolkit/cli/cli_list.py — sessions command + _resolve_harness_endpoint + a local _user_id_from_token. Output: table (SessionId / Events / LastUpdate) plus json/yaml/--quiet.
• docs/content/2.agentkit-cli/5.harness.md — new "list sessions" section.
• tests/toolkit/cli/test_cli_list_sessions.py — 6 tests: explicit user_id, JWT-sub derivation, key_auth fast-fail (asserts no network call), unknown harness, quiet, json.

Note (follow-up)

_user_id_from_token is duplicated locally here because the equivalent helper in cli_invoke (from the in-flight invoke harness run_sse work) is not yet on main — keeping this PR self-contained and independently mergeable. Once that work lands, both should consolidate into one shared helper.

Testing

uv run pytest tests/toolkit/cli/test_cli_list_sessions.py -q
6 passed

Also verified end-to-end against a live key_auth harness (explicit --user-id).

🤖 Generated with Claude Code