feat(proxy): configure trusted public upload origins
Summary
Build upload tickets from explicit publicOrigin or canonical ingress URLs. Ignore forwarding headers for origin selection; validate Node request targets and exactly one Host before dispatch. Fixes #4434.
For TLS-terminating tunnels, start the tunnel first, then run:
agent-device proxy --port 4310 --public-origin https://public.example:8443
Direct-daemon embeddings accept publicOrigin; Fetch embeddings supply canonical client-facing URLs. Health probes require Host. CLI, package README and website explain migration.
31 files cover validation, ticket builders, credential stripping, migration docs, HTTP/TLS/Fetch uploads and wire enforcement. Tenant confinement, framing and finalization retain their contracts.
Validation
Head 9d6087140e414872a00dca046a5644eebb910df1; base eec35e9622c339a21b1a588794254f6bdf50d476.
Pinned install/build, website check/build and exact affected validation passed: 42 checks, 361 related, 19,535 unit (three skipped), 274 provider tests. exactCommit=true, checkoutChanged=false. All 67 FAIL-OPEN-selected checks and #4050 retained; 25 stages have GitHub/manual owners.
Independent source/doc reviews found no findings. Earlier runtime proof at 6443aaa: controls 61 unit/15 provider passed before/after; sanitization, harness and false-TLS mutants caused three, two and one intended failures. The recorded base comparison passed one/failed one versus two candidate passes. Fixture regeneration completed a verified TLS exchange.
Current-head results and skipped owners. GitHub: 21 successful checks, one skipped; MERGEABLE/CLEAN. All threads resolved; Sentinel approves. Maintainer decision unset. Optional startup/API/client redesign deferred; historical timeout causes remain unproven. No merge performed.