fix(registry): lazy-heal platform_inbound_secret on register for legacy workspaces

[HongmingWang-Rabbit]

Summary

Pre-fix: a legacy SaaS workspace with NULL `platform_inbound_secret` needed two round-trips before chat upload worked:

1. Workspace registers → response missing `platform_inbound_secret`
2. User attempts chat upload → chat_files lazy-heals platform-side (RFC RFC: replace Docker-exec handlers with HTTP-forward to workspace's own URL (chat upload + 5 follow-ons) #2312 backfill) → 503 + retry-after
3. Workspace heartbeats → register response now includes the freshly-minted secret → workspace writes `/configs/.platform_inbound_secret`
4. User retries chat upload → workspace bearer matches → 200

The platform-side lazy-heal in #2366 closes the existing-workspace gap, but the user-visible round-trip dance is still ugly.

Changes

Lazy-heal at register time too. When `ReadPlatformInboundSecret` returns `ErrNoInboundSecret`, mint inline and include the freshly-minted secret in the register response. Collapses the dance to one round-trip.

Failure model: best-effort. Mint failure logs and falls through to omitting the field (workspace retries on next register call). The 200 response status is preserved — register success doesn't hinge on the inbound-secret heal.

Tests

• `TestRegister_NoInboundSecret_LazyHeals` — pins the success branch. Mocks the UPDATE explicitly + asserts `ExpectationsWereMet`, so a regression that skipped the mint would fail loudly. Replaces the prior `TestRegister_NoInboundSecret_OmitsField` which "passed" on this branch only because sqlmock-unmatched-UPDATE coincidentally drove the omit-field error path (same test-coverage gap I caught in chat_files for PR test(chat_files): pin lazy-heal mint contract for both Upload and Download #2370).
• `TestRegister_NoInboundSecret_LazyHealMintFailureOmitsField` — pins the failure branch: explicit UPDATE error → 200 + field absent.

Test plan

• Both new tests pass
• Full module green: `go test ./...`
• All other registry tests still pass (TestRegister_ReturnsPlatformInboundSecret_RFC2312_PRF etc.)

🤖 Generated with Claude Code