feat(runner): isolate structured workflows in one-attempt Kubernetes Pods

Stack 3 of 3, base `feat/workflow-rail-outbox`.

Stack 2 leased structured workflow attempts in the database and removed the
shared-daemon executor. This adds the executor that claims those leases: one
bare Kubernetes Pod and one capability Secret per attempt, for exactly one
attempt.

- `src/runner/`: the Pod-side process. One attempt, its own RPC client, its
  own output sanitizer, a token deadline, and a process boundary.
- `src/orchestrator/workflow-runner-*`: payload preparation, per-attempt
  capability minting, dispatch, result settlement, reconciliation and
  resource teardown, each fenced by run id, attempt id, owner id, lease and
  command receipt.
- `src/k8s/workflow-runner-spawner.ts`: creates the Pod, then makes the
  Secret a Kubernetes-owned dependent of that exact Pod UID.
- `src/shared/workflow-runner-messages.ts` is a separate schema from
  `ws-messages.ts`, not a superset, so a workflow-run can never enter the
  shared-daemon protocol by accident.
- Runner RPC output scanning is fail-CLOSED, unlike `safePostToGitHub`:
  scanner disablement, failure or timeout rejects the command. The Pod holds
  a repo-scoped write token and handles attacker-influenced content, so
  degrading to regex-only there is not an acceptable trade.
- New `admission-policy` CI job validates the runner admission spec against
  Kubernetes 1.30 via `bun run test:admission`.

Structured dispatch fails closed in PAT mode: a PAT cannot be narrowed to a
single repository.

Verified: typecheck, lint, format, all check gates, 213/213 test files
against live Postgres 17 + Valkey. The resulting tree is byte-identical to
the pre-split single-PR branch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KUPpJPtxAaHWrBsjytRGyM

Author: chrisleekr

.github/workflows/ci.yml

@@ -112,9 +112,8 @@ jobs:
         run: bun run check:runner-pins
 
       - name: Test-glob drift guard
-        # Fails if any `*.test.ts` file is not reachable by the runner glob in
-        # scripts/test-isolated.sh, so a colocated test outside the globbed
-        # roots cannot go dark while CI stays green. See issue #201.
+        # Fails if any `*.test.ts` file is outside the canonical `test/` tree
+        # consumed by scripts/test-isolated.sh.
         run: bun run check:test-globs
 
       - name: Destructive-action guard (FR-009)
@@ -190,3 +189,22 @@ jobs:
         # build/resolve drift class that shipped in 001990d before the daemon
         # image hits production. Must run AFTER `bun run build`.
         run: bun run check:mcp-bundle
+
+  admission-policy:
+    name: Workflow runner admission
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .tool-versions
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Validate admission against Kubernetes 1.30
+        run: bun run test:admission

.github/workflows/docker-build.yml

@@ -6,7 +6,10 @@
 #   - chrisleekr/github-app:<tag>-daemon        (rich, Claude worker)
 # Orchestrator additionally publishes a bare `<tag>` alias so existing
 # consumers that pull `chrisleekr/github-app:<version>` keep working.
-# `:latest` is published on prod releases only, on the orchestrator variant.
+# Each variant also gets a mutable `:latest-<variant>` alias, so `latest-daemon`
+# resolves on Docker Hub the same way it does on the GitLab registry. Both that
+# alias and the bare `:latest` (orchestrator only) are prod-release only: a beta
+# prerelease must not move a tag prod consumers follow.
 #
 # Multi-platform via the documented split-and-merge pattern:
 #   https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
@@ -185,6 +188,22 @@ jobs:
             GIT_HASH=${{ steps.meta.outputs.git_hash }}
             NODE_ENV=production
 
+      - name: Smoke daemon process boundary
+        if: matrix.variant == 'daemon'
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          docker pull "${IMAGE_NAME}@${DIGEST}"
+          docker run --rm \
+            --user 1000:1000 \
+            --read-only \
+            --network none \
+            --cap-drop ALL \
+            --security-opt no-new-privileges=true \
+            --entrypoint bun \
+            "${IMAGE_NAME}@${DIGEST}" \
+            run dist/daemon/process-boundary-smoke.js
+
       - name: Export digest
         env:
           DIGEST: ${{ steps.build.outputs.digest }}
@@ -256,6 +275,7 @@ jobs:
             type=raw,value=${{ steps.tag.outputs.variant_tag }}
             type=raw,value=${{ steps.tag.outputs.version }},enable=${{ matrix.variant == 'orchestrator' }}
             type=raw,value=latest,enable=${{ matrix.variant == 'orchestrator' && inputs.is-dev-release == false }}
+            type=raw,value=latest-${{ matrix.variant }},enable=${{ inputs.is-dev-release == false }}
 
       - name: Create manifest list and push
         working-directory: ${{ runner.temp }}/digests

CLAUDE.md

@@ -63,10 +63,9 @@ bun run test:watch        # re-run on file changes
 bun run test:coverage     # explicit coverage report (output in coverage/)
 ```
 
-Test files live under `test/` mirroring the `src/` directory structure, or
-colocated as `src/.../foo.test.ts`. Both are CI-gated: the runner globs
-`test/**/*.test.ts src/**/*.test.ts`, and `bun run check:test-globs` fails CI
-if any `*.test.ts` is unreachable by that glob set.
+Test files live under `test/`, mirroring the `src/` directory structure. The
+runner globs `test/**/*.test.ts`, and `bun run check:test-globs` fails CI if any
+`*.test.ts` file is placed outside that tree.
 
 **Coverage threshold**: `bunfig.toml` enforces a per-file minimum of **90%
 lines and 90% functions** via Bun's native `coverageThreshold`. Any PR that

CONTRIBUTING.md

@@ -2,9 +2,6 @@
 # Preload test environment setup before each test file
 preload = ["./test/preload.ts"]
 
-# Test timeout (ms) -- prevent hung tests in CI
-timeout = 30000
-
 # Coverage configuration.
 # coverageThreshold is applied per-file: every file must meet both minimums.
 # See https://bun.sh/docs/test/code-coverage#coverage-thresholds