test(e2e): restore self-host coverage harness for current session auth

[pythonlearner1025]

Problem

The current customer-POV self-host E2E harness cannot authenticate against current main.

tools/e2e/coverage.mjs mints a session by calling:

POST /sessions
Authorization: Bearer $OPERATOR_API_KEY

However, current identity/session routing no longer defines POST /sessions:

• packages/control-plane/core/sessions.ts exposes DELETE /sessions and POST /sessions/switch-org.
• Authentication is Google/session-cookie based through createSessionPrincipalSource.
• OPERATOR_API_KEY is now documented and implemented as an optional one-time bootstrap secret, not a general API credential.

A direct check against the canary/self-host deployment confirms POST /sessions returns HTTP 404. The older selfhost.mjs was removed, and repository records identify tools/e2e/coverage.mjs as its successor, so there is currently no runnable live self-host gate for the current auth model.

Impact

A contributor cannot run the documented live self-host coverage suites (quota-seam, volumes, destroy-while-creating, and broker-best-effort) against a current deployment, even with Cloudflare and Hetzner access. This removes the release gate that validates real workspace creation, persistence, teardown, and provider cleanup.

Proposed acceptance criteria

• Replace the removed operator-key login in tools/e2e/coverage.mjs with an explicit, supported noninteractive authentication mechanism for a designated test principal.
• Keep session/token values redacted from all output and child-process environments.
• Preserve existing destructive-run rails: explicit CP_URL, zero-active-resource preflight, create budget, workspace ledger, exact-label cleanup, and final leak audit.
• Add a fast authentication preflight that fails before any workspace or volume mutation.
• Run all coverage suites against the canary/self-host deployment and record fresh evidence.
• Update self-host/contributor documentation with the exact current command and required variable names.

Additional environment findings

These are operational prerequisites rather than necessarily repository defects:

• Live coverage also requires a Hetzner token and authorized access to the target deployment.
• Deploying the self-host target requires the real gitignored wrangler.toml and Cloudflare authorization; the generated template config must not be used for an existing deployment.