sorry for the delayed response.
I ended posting on this [0] thread where they (Formal) are doing something similar.
Here's the repo [1]. I modified it a bit to post publicly and remove the details of my setup within my tailnet/flycast network.
[0] >>46605155
[1] https://github.com/dtkav/agent-creds