fix(workspace): rename supported_protocols → supported_interfaces (CRITICAL — every boot crashes)

[HongmingWang-Rabbit]

Summary

CRITICAL: every workspace boot since the a2a-sdk 1.0 migration (#1974) has been crashing at AgentCard construction with:

ValueError: Protocol message AgentCard has no "supported_protocols" field.

The protobuf field is supported_interfaces (plural, interfaces — verified against a2a-sdk types/a2a_pb2.pyi:189). The 0.3→1.0 migration left the kwarg as supported_protocols, which doesn't exist in the 1.0 schema, so the constructor raises before any subsequent line of main() runs.

Why this hid for weeks

• publish-runtime.yml's smoke step only imported molecule_runtime.main; importing the module is fine, only constructing the AgentCard fails
• User-visible symptom is "Workspace failed: " with empty last_sample_error — indistinguishable from generic boot timeouts
• The state_transition_history=True bug (fixed in fix: drop state_transition_history (removed in a2a-sdk 1.x) #2179) was a sibling of this — same migration, same class, just caught first

Likely impact on recent CI failures

This is plausibly the root cause of the persistent staging failures we've been seeing:

• deps(canvas): bump postcss 8.5.9 → 8.5.12 (GHSA-qx2v-qp2m-jg93, medium) #2173 — Canvas tabs E2E: "Workspace failed: " with empty error
• ci: e2e-staging-saas on staging + canary auto-issue thresholded at 3 reds #2108 — E2E Staging SaaS: tenant teardown leak chain (workspace never reaches running, downstream tenant DELETE behavior diverges)
• canary failures 🔴 Canary failing: staging SaaS smoke #2090

I'm not 100% certain this single fix unblocks all three — there could be more bugs of the same class — but every boot has been crashing here, so fixing it removes one entire layer of failure.

Fix is symmetric with #2179

1. workspace/main.py: rename the kwarg + add a comment explaining why
2. .github/workflows/publish-runtime.yml: extend the smoke block to instantiate AgentCard with the exact production call shape, so the next field-rename of this class fails at publish time instead of breaking every workspace startup

Verification

I built a clean venv on a2a-sdk 1.0.2 and ran the constructor:

# With the WRONG kwarg (current production code):
ValueError: Protocol message AgentCard has no "supported_protocols" field.

# With the FIXED kwarg (this PR):
✓ AgentCard call-shape smoke passed

The smoke test in publish-runtime.yml is now a structural lock — main.py and the smoke MUST stay in lockstep. Adding a kwarg to one without mirroring it here is the regression vector for this class of bug.

🤖 Generated with Claude Code