refactor(kb): downgrade hf-token lookup info logs, keep warn on failure

The per-turn render path fires AgentClient resolution once per agent
per dynamic-block render — info-level logging on every call ("kb
AgentClient resolved token_present=true") drowns out actual signal.
Keep only the warn-level branch that fires when the lookup itself
errors (RPC failure, decrypt failure); silent success is the common
case and matches every other tool dispatch.

cmd/plexum-harborforge-plugin/main.go

@@ -213,6 +213,8 @@ func (p *harborForgePlugin) Init(ctx context.Context, host sdkplugin.HostAPI) er
 				}
 				token, err := host.GetAgentSecret(ctx, agentID, "hf-token")
 				if err != nil {
+					host.Log("warn", "kb hf-token lookup failed",
+						map[string]any{"agent": agentID, "err": err.Error()})
 					return nil, err
 				}
 				if token == "" {