feat: scope middleman inference to workload permissions - #1965

Overview

Workload inference must respect exact model approvals while charging usage and fair sharing to the submitting person. This adds workload authentication and model enforcement to Middleman, stacked on #1896.

Approach

Compare signed approvals with the exact registry entry dispatched, including opaque secret-model bindings. Read the shared issuer/audience/JWKS settings directly and validate the same string audience as the broker. Keep JWKS fetching and human issuer separation; invalid workload tokens never fall back to human authentication.

Authentication and traffic logs retain execution identity separately from accounting fields. Usage metrics and both priority paths require signed person/team attribution, so direct requests and executions share the person’s allocation. Dashboard queries retain legacy-log fallback and distinguish unknown from verified empty teams. New workload tokens reject missing/null attribution or teams; explicit empty teams remain valid. Preserve human email logging and metrics.

Risks

• Roll issuer and consumers together with names-only workload identity; the previous nested settings and array-valued workload audiences are unsupported.
• Historical execution-user metrics remain unchanged; team membership is captured at submission/resume.
• Secret-target retargeting or binding-key rotation requires fresh approval.
• Batch, background and legacy routes remain unavailable to workload credentials. Priority enforcement is not enabled by this change.

Testing & validation

All 2,087 Middleman tests and 180 affected Hawk tests passed. Coverage retains every provider route, real accounting/priority dispatch and malformed-attribution rejection. Full Hawk/Middleman types, Ruff/format, applicable hooks and independent spec/quality review passed. No deployment performed; live Logs Insights validation remains deployment acceptance.

• Verified the change works (commands / manual steps described above)
• Added or updated tests where it makes sense

Code quality

• pre-commit run --all-files passes (ruff, basedpyright/mypy, eslint/prettier/tsc, shellcheck — what CI's Lint job runs)

Before merging

• PR title is a Conventional Commit with a lower-case subject — it becomes the squash-merge commit subject and drives the SemVer bump
• All commits are signed and show as Verified on GitHub — see Commit signing