feat(runner): isolate structured workflows in one-attempt Kubernetes Pods

Stack 3 of 3, base `feat/workflow-rail-outbox`.

Stack 2 leased structured workflow attempts in the database and removed the
shared-daemon executor. This adds the executor that claims those leases: one
bare Kubernetes Pod and one capability Secret per attempt, for exactly one
attempt.

- `src/runner/`: the Pod-side process. One attempt, its own RPC client, its
  own output sanitizer, a token deadline, and a process boundary.
- `src/orchestrator/workflow-runner-*`: payload preparation, per-attempt
  capability minting, dispatch, result settlement, reconciliation and
  resource teardown, each fenced by run id, attempt id, owner id, lease and
  command receipt.
- `src/k8s/workflow-runner-spawner.ts`: creates the Pod, then makes the
  Secret a Kubernetes-owned dependent of that exact Pod UID.
- `src/shared/workflow-runner-messages.ts` is a separate schema from
  `ws-messages.ts`, not a superset, so a workflow-run can never enter the
  shared-daemon protocol by accident.
- Runner RPC output scanning is fail-CLOSED, unlike `safePostToGitHub`:
  scanner disablement, failure or timeout rejects the command. The Pod holds
  a repo-scoped write token and handles attacker-influenced content, so
  degrading to regex-only there is not an acceptable trade.
- New `admission-policy` CI job validates the runner admission spec against
  Kubernetes 1.30 via `bun run test:admission`.

Structured dispatch fails closed in PAT mode: a PAT cannot be narrowed to a
single repository.

Verified: typecheck, lint, format, all check gates, 213/213 test files
against live Postgres 17 + Valkey. The resulting tree is byte-identical to
the pre-split single-PR branch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KUPpJPtxAaHWrBsjytRGyM

Author: chrisleekr

.github/workflows/ci.yml

@@ -112,9 +112,8 @@ jobs:
         run: bun run check:runner-pins
 
       - name: Test-glob drift guard
-        # Fails if any `*.test.ts` file is not reachable by the runner glob in
-        # scripts/test-isolated.sh, so a colocated test outside the globbed
-        # roots cannot go dark while CI stays green. See issue #201.
+        # Fails if any `*.test.ts` file is outside the canonical `test/` tree
+        # consumed by scripts/test-isolated.sh.
         run: bun run check:test-globs
 
       - name: Destructive-action guard (FR-009)
@@ -190,3 +189,22 @@ jobs:
         # build/resolve drift class that shipped in 001990d before the daemon
         # image hits production. Must run AFTER `bun run build`.
         run: bun run check:mcp-bundle
+
+  admission-policy:
+    name: Workflow runner admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .tool-versions
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Validate admission against Kubernetes 1.30
+        run: bun run test:admission

.github/workflows/docker-build.yml

@@ -6,7 +6,10 @@
 #   - chrisleekr/github-app:<tag>-daemon        (rich, Claude worker)
 # Orchestrator additionally publishes a bare `<tag>` alias so existing
 # consumers that pull `chrisleekr/github-app:<version>` keep working.
-# `:latest` is published on prod releases only, on the orchestrator variant.
+# Each variant also gets a mutable `:latest-<variant>` alias, so `latest-daemon`
+# resolves on Docker Hub the same way it does on the GitLab registry. Both that
+# alias and the bare `:latest` (orchestrator only) are prod-release only: a beta
+# prerelease must not move a tag prod consumers follow.
 #
 # Multi-platform via the documented split-and-merge pattern:
 #   https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
@@ -185,6 +188,22 @@ jobs:
             GIT_HASH=${{ steps.meta.outputs.git_hash }}
             NODE_ENV=production
 
+      - name: Smoke daemon process boundary
+        if: matrix.variant == 'daemon'
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          docker pull "${IMAGE_NAME}@${DIGEST}"
+          docker run --rm \
+            --user 1000:1000 \
+            --read-only \
+            --network none \
+            --cap-drop ALL \
+            --security-opt no-new-privileges=true \
+            --entrypoint bun \
+            "${IMAGE_NAME}@${DIGEST}" \
+            run dist/daemon/process-boundary-smoke.js
+
       - name: Export digest
         env:
           DIGEST: ${{ steps.build.outputs.digest }}
@@ -256,6 +275,7 @@ jobs:
             type=raw,value=${{ steps.tag.outputs.variant_tag }}
             type=raw,value=${{ steps.tag.outputs.version }},enable=${{ matrix.variant == 'orchestrator' }}
             type=raw,value=latest,enable=${{ matrix.variant == 'orchestrator' && inputs.is-dev-release == false }}
+            type=raw,value=latest-${{ matrix.variant }},enable=${{ inputs.is-dev-release == false }}
 
       - name: Create manifest list and push
         working-directory: ${{ runner.temp }}/digests

.gitlab-ci.yml

@@ -119,6 +119,35 @@ test-unit:
   # No `coverage:` regex or artifact: test-isolated.sh runs one bun process per
   # file and prints output only on failure, so there is no aggregate to parse.
 
+admission-policy:
+  <<: *gate
+  # kind requires privileged DinD. This installation has no isolated ephemeral
+  # DinD runner, so never expose this job to branch-controlled pipelines.
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_COMMIT_REF_PROTECTED == "true"
+  image: oven/bun:1.3.14-alpine@sha256:5acc90a93e91ff07bf72aa90a7c9f0fa189765aec90b47bdbf2152d2196383c0
+  services:
+    - name: docker:29-dind@sha256:12e683a161823b2a839aeea999b9d960e6e1f9a97b1679ad6b441982e2d9cf07
+      alias: docker
+  variables:
+    DOCKER_HOST: tcp://docker:2376
+    DOCKER_TLS_CERTDIR: /certs
+    DOCKER_TLS_VERIFY: 1
+    DOCKER_CERT_PATH: $DOCKER_TLS_CERTDIR/client
+  before_script:
+    - apk add --no-cache docker-cli
+  script:
+    # kind publishes its API on the DinD host loopback. Run the harness in the
+    # remote daemon's host network so its kubeconfig points at the right host.
+    - >-
+      docker run --rm --network host
+      --volume /var/run/docker.sock:/var/run/docker.sock
+      --volume "$CI_PROJECT_DIR:$CI_PROJECT_DIR"
+      --workdir "$CI_PROJECT_DIR"
+      oven/bun:1.3.14-alpine@sha256:5acc90a93e91ff07bf72aa90a7c9f0fa189765aec90b47bdbf2152d2196383c0
+      sh -ec 'apk add --no-cache bash ca-certificates coreutils curl docker-cli
+      && bun run test:admission'
+
 # The invariant guards from .github/workflows/ci.yml. They catch stale generated
 # artifacts and drifted pins, which a build alone cannot see.
 guards:
@@ -184,6 +213,11 @@ publish-dev-npm:
       artifacts: false
     - job: test-unit
       artifacts: false
+    # `optional: true`: this job's rule excludes it on non-protected refs, and
+    # a required edge to an excluded job rejects pipeline creation outright.
+    - job: admission-policy
+      artifacts: false
+      optional: true
     - job: guards
       artifacts: false
     - job: build