feat(server): activate projected authentication safely

tools/tht/internal/doctor/report.go

@@ -28,6 +28,8 @@ const (
 
 const probeTimeout = 5 * time.Second
 
+var requireRuntimeAuthProjectionReady = authconfig.RequireRuntimeAuthProjectionReady
+
 const registryValidationProgram = `const fs=require("node:fs");const path="/data/workspace-registry/state/active.json";const s=JSON.parse(fs.readFileSync(path,"utf8"));const hex=/^[0-9a-f]{40}$/;if(!hex.test(s.head)||!Array.isArray(s.revisions)||s.revisions.some((r)=>!r||typeof r.id!=="string"||!r.id||!hex.test(r.commit)||!hex.test(r.blob))){process.exit(1)}for(const r of s.revisions){fs.accessSync("/data/workspace-registry/snapshots/"+r.commit+"/"+r.id+".yaml",fs.constants.R_OK)}`
 
 // Check is one named, redacted diagnostic outcome.
@@ -118,6 +120,13 @@ func RunWithProbe(ctx context.Context, installation config.Installation, runner
 	} else {
 		add("files", StatusPassed, "declared host files have safe permissions")
 	}
+	if installation.HasRuntimeAuthProjection() {
+		if err := requireRuntimeAuthProjectionReady(installation); err != nil {
+			add("auth-projection", StatusFailed, "runtime authentication projection is unavailable")
+			return finalize(report), nil
+		}
+		add("auth-projection", StatusPassed, "runtime authentication projection is ready and equal to canonical authentication")
+	}
 	if secretErr != nil {
 		add("docker", StatusSkipped, "declared secret files are unavailable")
 		add("compose", StatusSkipped, "declared secret files are unavailable")