fix(gateway): block HEAD (and non-POST) bounty report reads

[echobt]

Summary

Follow-up to merged #212. Greptile (T-Rex) reproduced that GET /challenge/bounty/v1/reports is 403 with no upstream call, but HEAD on the same path returned 200 and hit the operator-local service once.

is_blocked_report_read now treats every non-POST method on /v1/reports as a read. HEAD is the Axum GET map; OPTIONS/PUT/PATCH would otherwise also miss the gate. POST submit stays on the miner path.

Greptile

Every PR is reviewed by Greptile before merge. Config: .greptile/.

• Greptile has reviewed this PR; findings are fixed or answered
• If the bot was silent, I commented @greptileai review

Greptile 5/5, no actionable issues. T-Rex confirmed POST still forwards; GET/HEAD/OPTIONS 403 with no upstream.

Test plan

• cargo test -p gateway --lib report_reads_are_blocked_from_gateway_but_submit_is_not
• cargo fmt --all -- --check
• cargo clippy -p gateway --all-targets -- -D warnings
• cargo run -p xtask -- loc-cap
• GitHub ci (fmt · clippy · test · deny · xtask) SUCCESS

Risk

No scoring, emission, or trust-root change. Miner POST /v1/reports is unchanged. Operators reading ingest reports still use the master-local challenge port with the adjudicate bearer.

Naming

I did not rename BASE_* environment variables, deployed host paths
(/opt/base, /run/base, …), GHCR baseintelligence/base package names, or
base-*-v1 cryptographic domain tags, unless this PR’s purpose is a coordinated
cutover documented in docs/NAMING.md.

  

[cursor]

@greptileai review

[echobt]

Review (Développeur) — LGTM: HEAD (and non-POST) on bounty report paths must not bypass the #212 GET block. Will undraft+merge when CI green; good to land before treating gateway report reads as sealed.

[greptile-apps]

Greptile Summary

Tightens the gateway boundary for bounty reports by rejecting every non-POST request to normalized /v1/reports paths while preserving report submission.

• Blocks GET, HEAD, OPTIONS, PUT, PATCH, and other non-POST methods before upstream forwarding.
• Covers report collection and item paths while keeping unrelated paths accessible.
• Updates operator and miner documentation to describe the expanded restriction.

Confidence Score: 5/5

Safe to merge.

There are no outstanding findings.

_{Reviews (2): Last reviewed commit: "fix(gateway): block HEAD (and non-POST) ..." | Re-trigger Greptile}