feat(broker): egress-auth broker (runner side)

[ysyneu]

Egress-auth broker (runner side)

Turns the runner into a local authenticating broker so the fduty CLI's outbound API calls authenticate without the app_key ever entering the bash environment.

What changes

• New environment/broker_linux.go (//go:build linux): per-invocation socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC) control channel; child end inherited by bash as fd 3 via cmd.ExtraFiles; a control goroutine answers each handshake by minting a dedicated SOCK_STREAM connection and passing it back via SCM_RIGHTS, then serves an httputil.ReverseProxy that overwrites the sentinel ?app_key= with the real per-person key and forwards to the upstream. PR_SET_DUMPABLE=0 hardens the runner's in-memory keys.
• environment/broker_other.go (//go:build !linux): BrokerSupported=false + stubs. darwin/windows don't carry the broker and fall back to the legacy env-key path.
• executeBashCommand accepts *protocol.BashCredential; in broker mode it sets FLASHDUTY_CRED_FD=3 + an http placeholder base URL and never puts the key in cmd.Env.
• protocol.BashCredential{Key, BaseURL} + BashArgs.Credential.
• ws/client.go: advertises &broker=1 on WS connect iff BrokerSupported.

Robustness (control channel)

• Validates the control request byte; a malformed datagram (e.g. a confused in-sandbox process that inherited fd 3) is refused with 0xFF and never mints a connection.
• The fd dispatch wraps and verifies the runner's own end with net.FileConn before handing the peer its fd, so a net.FileConn failure refuses cleanly instead of stranding the peer with a connection that never gets served.
• Clones http.DefaultTransport (guarded type assertion) with a ResponseHeaderTimeout backstop; BaseContext ties each per-conn server to broker shutdown so teardown promptly cancels in-flight upstream requests.

Why

The app_key in the bash env leaks via printenv and /proc/<sibling>/environ on shared-uid hosts. The broker keeps the key in runner memory only; attribution is by-construction (the runner is the parent of each bash, fd 3 is private to that invocation). Linux-only by construction (SOCK_CLOEXEC/PR_SET_DUMPABLE are undefined on darwin); capability is negotiated so a heterogeneous BYOC fleet stays correct.

Verification

• Unit: TestServeBrokerControl_RewritesKeyAndProxies (Linux, in container) — control channel + SCM_RIGHTS dispatch + key rewrite + the 0xFF refusal path; passes under -count=3 with no fd/goroutine leak.
• E2E (TestBrokerE2E_RealFduty, opt-in): real fduty through the broker → real local pgy → authenticated real data; app_key absent from bash env (FLASHDUTY_CRED_FD=3 only); two concurrent fduty both authenticate, no byte interleave.
• Live: this runner connected to a local Safari, advertised broker=1 (Safari logged broker=true); an AI-SRE session ran fduty channel list through the broker and returned real channels with exit_code:0. Container had no FLASHDUTY_APP_KEY — the only auth path was the broker.
• Builds clean for linux, darwin, windows (amd64/arm64).