feat(auth): authorize a discovery-only reader across all workspaces #4668

• Parent: Sandbox Service Exposure #4310
• Dependencies: feat(gateway): publish accepted supervisor service routes for discovery #4667.

User Story

I operate an OpenShell deployment serving sandboxed applications. I need openshell-sandbox-proxy to read service routes across the platform using its own noninteractive identity, without my user login or gateway administrator credentials.

Problem Statement

The workspace-scoped discovery introduced in #4667 does not provide a dedicated platform-wide machine reader. An mTLS operator certificate grants gateway-wide administration and provider credential retrieval, while the proxy only needs routing information. Discovery needs an explicitly authorized all-workspaces selector.

Impact / Why This Matters

Granting the router administration substantially exceeds its function. Per-user credentials expire independently of the router, while per-workspace membership management does not provide a platform-wide routing identity.

Proposed Design

Add an explicitly granted discovery-only capability valid across all active workspaces, including newly created ones. It permits only GetServiceRouteSnapshot and WatchServiceRoutes. It is not a general platform reader, a workspace user grant, or an operator/admin identity.

Bind the grant to a trusted authenticated machine identity, with a documented certificate-based path so the proxy can use mTLS without an operator certificate. Define the authoritative administrator-controlled grant/mapping and credential renewal/revocation behavior. Client-supplied claims or ordinary certificates must not self-assign this capability.

Extend only the discovery methods to accept the existing all-workspaces selector for authorized platform discovery readers (and explicitly authorized existing administrators). The gateway aggregates valid routes internally; the identity does not need ListWorkspaces or other resource APIs. Preserve explicit-workspace queries and existing workspace-user restrictions. All-workspaces snapshots and watches must have bounded collection/output and follow workspace creation and deletion. Grant revocation stops the watch within a documented bound.

Suggested UX

Notional workflow: an administrator binds the proxy's trusted machine identity to the discovery-reader grant; the proxy presents that identity and sends:

{
  "workspaceScope": {
    "allWorkspaces": {}
  }
}

The response contains only discovery route metadata, including each route's workspace. Exact grant/configuration names remain a design decision; this is not a proposed general read-only role.

Acceptance Criteria

• A noninteractive identity without workspace membership or admin/operator privileges can snapshot/watch routes across active workspaces.
• Newly created workspaces are covered without manually adding memberships; removed workspaces withdraw their routes.
• General resource listing/reads, mutations, exec, forwarding, secret/provider credential retrieval, and peer/supervisor RPCs are denied.
• Only the two discovery methods accept the new grant; unclassified/new RPCs do not inherit it automatically.
• Authentication, descriptor authorization, and handler scope checks agree; existing workspace users cannot broaden their scope through this change.
• mTLS provisioning and grant mapping do not require OU=operator, user OIDC login, or administrator credentials in the proxy.
• Credential renewal, grant revocation during watches, and discovery denial/cache withdrawal are tested and documented.
• Cross-workspace aggregation and workspace lifecycle tests cover bounds and isolation; responses expose no credentials or unrelated platform resources.

Alternatives Considered

Retaining operator credentials preserves excessive privileges. A general platform reader exposes unrelated metadata and is outside the requested scope. Per-workspace identities add lifecycle administration. OIDC/service credentials can authenticate a machine, but do not alone define its discovery authorization. Interceptors, middleware, and credential providers should not bypass the gateway authorization boundary.

Agent Investigation

Principal::Operator currently has administrator grants. Workspace-scoped discovery must preserve sandbox:read and workspace membership checks through authorize_workspace; the shared role model needs a separate discovery-reader grant. The existing WorkspaceSelector.all_workspaces marker can express the desired request, but discovery handlers need explicit authorization for that scope. This issue therefore needs both authorization support and a bounded cross-workspace discovery behavior.