[factory] Canary — post-JIT-fixes verify

[kjgbot]

Canary — post-JIT-fixes verify (full end-to-end)

Proves the full JIT path is live end-to-end after the ship of:

• cloud#3214 — widen fleet-provisioning gate to accept source: "relayfile" bearers
• cloud#3218 — replace scope check with signed-identity match (sub === 'agent_agent-relay-factory' AND wks === 'rw_7ccfea89')
• cloud#3219 — revert cloud#3216 (mint-side scope now dead)
• cloud#3215 — flush-failure fatal (Fix B)
• relaycast#360 — tag preservation (Fix C)
• factory-cloud#82 — closed (grant-side scope obsolete under identity auth)

Expected path

1. factory sweep picks this issue up (labels: factory, factory-ready, agent:single).
2. RelayFleetClient.spawn() invokes the provisionSandbox hook.
3. container/sandbox-provisioner.mjs POSTs to /cloud/api/v1/fleet/nodes/sandbox/ensure with repos: ["AgentWorkforce/factory"].
4. Cloud's requireFleetProvisioningAuth/isFleetProvisioningServiceAuth admits the factory JWT by signed identity (not by scope).
5. Cloud provisions a fresh Daytona sandbox, mounts Relayfile, clones the repo into /srv/agent-workforce/factory.
6. The enrolled sandbox comes online with a cloud:node-type:*-jit tag (visible in query_nodes).
7. Placement lands the spawn on that node.
8. Broker resolves worker_cwd: /srv/agent-workforce/factory, cds into the fresh clone, spawns the harness.
9. Agent opens a branch, drafts a PR, and posts a writeback comment back to this issue (kjgbot).

Definition of done

• New cloud:node-type:*-jit node appears in query_nodes when dispatch fires
• A factory-app-authored branch/PR is opened against AgentWorkforce/factory for this canary
• kjgbot writeback comment lands on this issue linking the PR
• No readinessReconcile stall; step metadata stepStatus.error field is either absent or well-formed (no wedge)

Trivial task for the agent

Append one line to README.md:

Canary — post-JIT-fixes verify — <ISO-8601 timestamp>

Open a PR titled chore: post-JIT-fixes canary targeting main. Don't merge — leaving the PR open is the signal.

[khaliqgant]

Factory human input request

Agent: ar-418-impl-factory
Issue: 418
Question: Can you restore/register the factory.lifecycle Relay action and re-dispatch issue 418 so the required completed signal can be accepted?