feat(saas): deliver platform_inbound_secret via /registry/register (RFC #2312, PR-F)

[HongmingWang-Rabbit]

Summary

Closes the SaaS-side gap that PR-A acknowledged but didn't fix. Without this PR, even after A+B+C land, SaaS chat upload still 401s. With this PR, SaaS chat upload actually starts working.

Stacks: PR-A #2313 → PR-B #2314 → PR-C #2315 → this PR.

Why this is needed

PR-A skips writing `/configs/.platform_inbound_secret` in SaaS mode (no Docker volume to write into). The plaintext lives in the DB column, but the workspace's `/configs/.platform_inbound_secret` is empty, so the workspace's auth gate (PR-B) fails-closed → 401 on every platform forward (PR-C).

What this does

`/registry/register` response now includes `platform_inbound_secret` alongside the existing `auth_token`. The runtime extracts it and persists to `/configs/.platform_inbound_secret` at mode 0600. Idempotent — Docker-mode workspaces also receive it and overwrite the value the provisioner already wrote (same value until rotation).

Why on every register, not just first-register

• SaaS containers can be restarted (deploys, drains, EBS detach/re-attach) — `/configs` is rebuilt empty on each fresh start
• The auth_token is "issue once" because re-issuing rotates and invalidates the previous one. The inbound secret has no rotation flow yet (Design rotation flow for platform_inbound_secret (workspace-side cache invalidation) #2318) so re-sending the same value is harmless
• Eliminates the bootstrap window where a restarted SaaS workspace has no inbound secret on disk

Changes

File	What
`workspace-server/internal/handlers/registry.go`	Register handler reads `workspaces.platform_inbound_secret` via `wsauth.ReadPlatformInboundSecret` and includes it in response. Legacy workspaces (NULL column) get successful registration with field omitted.
`workspace-server/internal/handlers/registry_test.go`	2 new tests: secret-present-in-DB → secret-in-response (alongside auth_token); NULL column → field-omitted, registration still 200
`workspace/platform_inbound_auth.py`	`save_inbound_secret(secret)` — atomic tmp+rename write, mode 0600 from `os.open(O_CREAT, 0o600)`, resets in-process cache so next `get_inbound_secret()` returns the freshly-written value (rotation-safe when it lands)
`workspace/main.py`	Register-response handler extracts `platform_inbound_secret` alongside `auth_token` and persists via `save_inbound_secret`
`workspace/tests/test_platform_inbound_auth.py`	6 new tests: writes file, mode 0600, overwrite-existing, cache invalidation after save, empty-input no-op, parent-dir creation for fresh installs

Test results

• `go test ./internal/handlers/ ./internal/wsauth/` — all green
• `pytest workspace/tests/` — 1272 passed (was 1266 before this PR; 6 new save_inbound_secret tests)

Test plan

• Unit tests pass (Go + Python)
• Build (`go build ./...`) green
• After A+B+C+F merge + cascade re-publishes runtime + template images: run E2E against fresh staging tenant
• Confirm SaaS workspace's `/configs/.platform_inbound_secret` is populated post-register (`docker exec ... cat /configs/.platform_inbound_secret`)
• Confirm chat upload via canvas → 200 (not 401) on staging tenant

Refs

• `RFC: replace Docker-exec handlers with HTTP-forward to workspace's own URL (chat upload + 5 follow-ons) #2312` — parent RFC
• `[Bug] File upload to external/remote workspace returns 503 'container not running' (split from #2305) #2308` — chat upload 503 incident
• PR `feat(wsauth): platform→workspace inbound secret (RFC #2312, PR-A) #2313` — PR-A foundation
• PR `feat(workspace): /internal/chat/uploads/ingest endpoint (RFC #2312, PR-B) #2314` — PR-B workspace endpoint
• PR `feat(chat_files): rewrite Upload as HTTP-forward (RFC #2312, PR-C) #2315` — PR-C platform forward
• `Design rotation flow for platform_inbound_secret (workspace-side cache invalidation) #2318` — rotation flow design (when we add one, the cache-invalidation in `save_inbound_secret` is the hot-path that handles it)

🤖 Generated with Claude Code

[HongmingWang-Rabbit]

Coverage audit before approval. ~85% branch coverage; security-critical paths covered, gaps are error fallthroughs. Consistent with the hold on PR-A/B/C.

Production code changes (3 places):

1. registry.go::Register — adds ReadPlatformInboundSecret call and conditionally adds the field to response
2. workspace/main.py register-response handler — calls save_inbound_secret (in pragma: no cover, fine)
3. platform_inbound_auth.py::save_inbound_secret — new function

Tests added: 8 (2 Go + 6 Python)

Covered:

• Go: secret-on-file → response includes it (TestRegister_ReturnsPlatformInboundSecret_RFC2312_PRF)
• Go: NULL secret → response omits field (TestRegister_NoInboundSecret_OmitsField)
• Python: empty input → noop, write file, 0600 mode, overwrite, cache invalidation, parent-dir creation

Gaps:

• Go: non-ErrNoInboundSecret DB error in ReadPlatformInboundSecret → handler logs + skips field. Untested. Worth adding because the log line is the only signal ops gets that something's wrong.
• Python: os.open / os.replace raises OSError → cleanup branch (os.unlink of tmp). Untested. Disk-full / read-only-fs would hit this. The cleanup is best-effort but the early return matters for fail-loud-not-silent.

Re-approve once these are pinned.