feat(chat_files): rewrite Download as HTTP-forward (RFC #2312, PR-D)

[HongmingWang-Rabbit]

Summary

Mirrors PR-C's Upload migration. Replaces the docker-cp tar-stream extraction with a streaming HTTP GET to the workspace's own `/internal/file/read` endpoint. Closes the SaaS gap for downloads — without this PR, `GET /workspaces/:id/chat/download` still returns 503 on Railway-hosted SaaS even after A+B+C+F land.

Stacks: PR-A `#2313` → PR-B `#2314` → PR-C `#2315` → PR-F `#2319` → this PR.

Why a single broad `/internal/file/read` (not chat-specific)

Today's `chat_files.go::Download` already accepts paths under any of the four allowed roots `{/configs, /workspace, /home, /plugins}` — it's not strictly chat. Future PRs (template export, etc.) reuse this endpoint via the same forward pattern, avoiding three near-identical handlers with duplicated path-safety logic.

Path safety is duplicated on platform + workspace sides — defence in depth via two parallel checks, not "trust the workspace."

Changes

• `workspace/internal_file_read.py` — Starlette handler. Validates path (must be absolute, under allowed roots, no traversal, canonicalises cleanly). `lstat` (not `stat`) so a symlink at the path doesn't redirect the read. Streams via `FileResponse` (no buffering). Mirrors Go's `contentDispositionAttachment` for `Content-Disposition` header.
• `workspace/main.py` — registers `GET /internal/file/read` alongside `POST /internal/chat/uploads/ingest` from PR-B.
• `scripts/build_runtime_package.py` — adds `internal_file_read` to `TOP_LEVEL_MODULES` so the publish-runtime cascade rewrites its imports correctly. Also includes PR-B's `internal_chat_uploads` + `platform_inbound_auth` (this branch was rooted before PR-B's drift-gate fix; merge-clean alphabetic additions).
• `workspace-server/internal/handlers/chat_files.go` — `Download` rewritten as streaming HTTP GET forward. Resolves workspace URL + `platform_inbound_secret` (same shape as Upload), builds GET request with path query param, propagates response headers (`Content-Type` / `Content-Length` / `Content-Disposition`) + body. Drops `archive/tar` + `mime` imports. Drops Docker-exec branch entirely.
• `workspace-server/internal/handlers/chat_files_test.go` — replaces `TestChatDownload_DockerUnavailable` (stale post-rewrite) with 4 new tests:
  • `TestChatDownload_WorkspaceNotInDB` → 404 on missing row
  • `TestChatDownload_NoInboundSecret` → 503 on NULL column (with RFC RFC: replace Docker-exec handlers with HTTP-forward to workspace's own URL (chat upload + 5 follow-ons) #2312 detail)
  • `TestChatDownload_ForwardsToWorkspace_HappyPath` → forward shape (auth header, GET method, `/internal/file/read` path) + headers propagated + body byte-for-byte
  • `TestChatDownload_404FromWorkspacePropagated` → 404 from workspace propagates (NOT remapped to 500)
  • Existing `TestChatDownload_InvalidPath` path-safety tests preserved.
• `workspace/tests/test_internal_file_read.py` — 21 tests covering `_validate_path` matrix, 401 auth surfaces, 400 path-safety surfaces, 404 missing file, happy-path streaming, special-char escaping in Content-Disposition, symlink-redirect-rejection (lstat-not-stat protection).

Test results

• `go test ./internal/handlers/ ./internal/wsauth/` — green
• `pytest workspace/tests/` — 1292 passed (was 1272 before this PR)

Test plan

• Unit tests pass (Go + Python)
• Build (`go build ./...`) green
• Drift gate verified: `python3 scripts/build_runtime_package.py --version 0.0.0-test` produces a clean package with `internal_file_read.py` and correct import rewrites
• After A+B+C+F+D merge + cascade re-publishes runtime + template images: run full E2E (`tests/e2e/test_chat_upload_e2e.sh`) including the read-back step against fresh staging tenant
• Confirm SaaS download via canvas → 200 with proper headers (not 503)

Refs

• `RFC: replace Docker-exec handlers with HTTP-forward to workspace's own URL (chat upload + 5 follow-ons) #2312` — parent RFC
• `[Bug] File upload to external/remote workspace returns 503 'container not running' (split from #2305) #2308` — chat upload+download 503 incident
• PR `feat(wsauth): platform→workspace inbound secret (RFC #2312, PR-A) #2313` — PR-A foundation
• PR `feat(workspace): /internal/chat/uploads/ingest endpoint (RFC #2312, PR-B) #2314` — PR-B workspace upload endpoint
• PR `feat(chat_files): rewrite Upload as HTTP-forward (RFC #2312, PR-C) #2315` — PR-C platform upload forward
• PR `feat(saas): deliver platform_inbound_secret via /registry/register (RFC #2312, PR-F) #2319` — PR-F SaaS secret delivery

🤖 Generated with Claude Code

[HongmingWang-Rabbit]

Coverage audit before approval. ~85% branch coverage; security-critical paths covered, gaps are error fallthroughs. Consistent with the hold on PR-A/B/C/F.

Production code changes (2 surfaces):

1. chat_files.go::Download — full rewrite (docker-cp → HTTP forward)
2. internal_file_read.py — new endpoint (file_read_handler + _validate_path + _content_disposition_attachment)

Tests added: 4 Go + 17 Python (including 11-row parametrized _validate_path matrix)

Covered (security-critical):

• Path validation: empty / non-absolute / outside allowed roots / traversal / double-slash — 11 parametrized cases
• Auth: no-bearer / wrong-bearer 401
• lstat (not stat) symlink-redirect refusal — explicit test plants symlink off-tree, asserts 400 'regular file' error
• Content-Disposition escapes quotes / CR/LF / non-ASCII
• Happy-path forward: shape (method, path, Authorization), body bytes, headers (Content-Type, Content-Disposition) round-trip
• Workspace-side 404 → propagated as 404 to caller
• Workspace not in DB → 404
• No platform_inbound_secret → 503 with RFC reference

Gaps:

• Go: empty URL (workspace registered but URL not reported yet) → 503 — untested
• Go: non-ErrNoInboundSecret error in ReadPlatformInboundSecret → 500 — untested
• Go: httpClient.Do error → 502 — untested (Upload has TestChatUpload_WorkspaceUnreachable, Download lacks the symmetric one)
• Python: lstat OSError other than FileNotFoundError → 500 'stat failed' — untested
• Python: test_400_when_path_is_directory is explicitly pytest.skip'd. The S_ISREG check is exercised by the symlink test (which is not-regular-file), but a directory-as-target path isn't pinned independently. Either remove the skip with a tmp_path-redirect-roots approach, or add an integration test.

Re-approve once these are pinned (the symmetric Download → unreachable test is the most valuable — it's a failure mode you'd want a test for if the workspace-server URL stops responding mid-deploy).