feat: Phase 2 Workstream 3 — Go SDK (github.com/sentryagent/idp-sdk-go)

Single-package agentidp SDK in sdk-go/:
- AgentIdPClient composing AgentRegistryClient, CredentialClient,
  TokenServiceClient, AuditClient — all 14 endpoints covered
- Goroutine-safe TokenManager (sync.Mutex) with 60s refresh buffer
- AgentIdPError implementing error interface with Code/HTTPStatus/Details
- Context-aware: all service methods take context.Context as first arg
- doRequest shared helper; token endpoints use form-encoded POST directly
- go vet: 0 warnings | staticcheck: 0 warnings
- go test ./...: 37/37 passed | coverage: 81.0% (>80% gate)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sdk-go/request.go

@@ -0,0 +1,79 @@
+package agentidp
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+)
+
+// doRequest performs an authenticated JSON HTTP request.
+//
+//   - method: HTTP method (GET, POST, PATCH, DELETE)
+//   - url:    full URL (base + path + query)
+//   - body:   request body (marshalled to JSON), or nil for bodyless requests
+//   - token:  Bearer token for Authorization header
+//   - out:    pointer to unmarshal the response body into, or nil to discard
+//
+// Returns nil on 2xx; returns *AgentIdPError on HTTP errors or network failures.
+// 204 No Content responses are considered success; out is not populated.
+func doRequest(ctx context.Context, client *http.Client, method, url string, body interface{}, token string, out interface{}) error {
+	var bodyReader io.Reader
+	if body != nil {
+		b, err := json.Marshal(body)
+		if err != nil {
+			return &AgentIdPError{
+				Code:       "SERIALIZATION_ERROR",
+				Message:    fmt.Sprintf("failed to marshal request body: %s", err.Error()),
+				HTTPStatus: 0,
+			}
+		}
+		bodyReader = bytes.NewReader(b)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, method, url, bodyReader)
+	if err != nil {
+		return &AgentIdPError{
+			Code:       "REQUEST_BUILD_ERROR",
+			Message:    fmt.Sprintf("failed to build request: %s", err.Error()),
+			HTTPStatus: 0,
+		}
+	}
+
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.Header.Set("Accept", "application/json")
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return newNetworkError(err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return newNetworkError(err)
+	}
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return parseAPIError(respBody, resp.StatusCode)
+	}
+
+	if out != nil && resp.StatusCode != http.StatusNoContent {
+		if err := json.Unmarshal(respBody, out); err != nil {
+			return &AgentIdPError{
+				Code:       "PARSE_ERROR",
+				Message:    fmt.Sprintf("failed to parse response: %s", err.Error()),
+				HTTPStatus: resp.StatusCode,
+			}
+		}
+	}
+
+	return nil
+}