fix(serviceoffer-controller): harden agent reconciliation and storefront

[bussyjd]

Summary

Pulls forward five small correctness fixes that were carried on the integration branch behind #452 but did not survive the squash merges.

• S1 — Agent → ServiceOffer fan-out (controller.go, agent.go). Re-queue every ServiceOffer whose spec.agent.ref points at an Agent when the Agent changes. Without this, an Agent status edit (e.g. status.pinnedModel after the user edits spec.model) never propagates into the offer's status.agentResolution because the offer reconciler only runs when the offer itself changes.
• S2 — Create-only kinds (agent.go). applyAgentObject returns success for Namespace and PersistentVolumeClaim instead of trying to Update. PVCs reject wholesale Update with spec is immutable after creation, and the controller's RBAC only grants create on Namespaces. Mutable kinds (ConfigMap, Secret data, Deployment, Service ports, ServiceAccount) keep going through the normal Update path so reconciles still pick up rendered changes.
• S3 — Agent-offer model fallback (render.go). type=agent offers leave spec.model empty by design (the model lives on the linked Agent). Fall back to status.agentResolution.Model so the storefront catalog can display it.
• S4 — Memory bump (x402.yaml). Bump the serviceoffer-controller Deployment request from 64Mi → 128Mi and limit from 256Mi → 512Mi. The Agent informer + agent reconciler + in-controller keystore generation pushed steady-state past 256Mi after #453 and triggered OOMKilled restart loops.
• S5 — GATEWAY_ALLOW_ALL_USERS=true (agent_render.go). CRD agents expose only the API (gated by API_SERVER_KEY + ForwardAuth); no Telegram/Discord/dashboard platforms are wired. The flag silences Hermes' user-gateway startup warning without opening any real surface.

Test plan

• go build ./...
• go test ./internal/serviceoffercontroller/... — all green, including the existing storefront catalog tests
• On a live cluster: edit an Agent's spec.model and confirm the linked offer's status.agentResolution.Model updates without manually poking the offer
• On a live cluster: delete + re-apply an Agent and confirm the controller does not error on PVC update attempts
• On a live cluster: confirm serviceoffer-controller pod has no OOMKilled restarts after seeding several Agents