Support restricted Tangled authentication from self-hosted CI virtual machines #1

Self-hosted CI jobs running inside disposable virtual machines need to publish artifacts and report results to Tangled without copying a long-lived OAuth session or refresh token into the guest.

Add a restricted authentication-agent mode to tng:

• allow a dedicated CI identity to log in with a ci-reporting profile stored in an explicitly selected session file;
• serve that session from a private host Unix socket;
• define a versioned framed protocol that a trusted VM host can bridge to a fixed guest vsock endpoint;
• bind every bridged connection to a trusted job ID, repository DID, operation set, and deadline before accepting guest requests;
• allow only artifact uploads and issue or pull request comments for the bound repository;
• enforce separate limits for protocol bodies, cumulative job uploads, and Tangled artifact blobs;
• make ordinary authenticated commands prefer TNG_AUTH_AGENT when present, while never exposing OAuth tokens through agent status output.

The initial endpoint is vsock://host:10241. Default limits are 128 MiB per protocol body, 512 MiB cumulative attempted uploads per job, and 50 MiB per artifact blob.

Account selection remains host-controlled. Operators can run one broker and session file per CI identity and select the corresponding socket in each worker configuration. A future general multi-account CLI selector should use the precedence TNG_AUTH_AGENT > TNG_SESSION_FILE > explicit account option

active/default account.

The matching spindle-agent work should validate and probe the private host socket at startup, inject only TNG_AUTH_AGENT=vsock://host:10241 into the VM, bind the host side from trusted Gateway job metadata, and close the bridge on cancellation or cleanup. No Gateway protocol change is required.

Acceptance criteria #

• Legacy sessions remain readable and ordinary local authentication continues to work when TNG_AUTH_AGENT is unset.
• The restricted login requests only the scopes needed for artifact and comment reporting.
• The broker refuses unbound, expired, cross-repository, unsupported-operation, oversized, and over-quota requests.
• The guest receives no session archive, access token, refresh token, or DPoP key.
• Multiple CI identities can coexist on one self-hosted machine through separate session files, broker sockets, and worker configurations.
• Unit tests cover framing, endpoint validation, session compatibility, socket permissions, and a real Unix-socket probe.
• A self-hosted VM smoke test verifies status plus one authorized reporting operation and confirms that an unauthorized operation is denied.