The runtime credential channel

[zxgshawn]

Makes the dial token the only credential in a runtime's environment, and mints everything else on demand against it.

Two secrets used to ride the environment and expire there: the GitHub token (~1h) and the plugin artifact token (1h). RuntimeManager re-minted both on every acquisition, but Fly and velos discard the spec on get (let _ = spec;), so the environment is frozen at create — a runtime up for an hour holds a dead GitHub token, and a resumed machine comes back with the one it was born with. Nothing could renew either: no protocol message, and no substrate can rewrite a running machine's environment.

The dial token is different — horsie mints it, horsie verifies it, it never expires — so it can be the root that fetches the rest. That was blocked by horsie connect signing with a per-process random secret the server had never seen, which made its runtimes' tokens meaningless to the server.

The server now mints every dial token, shipped in RuntimeSpec.env alongside the other server-minted values. No new endpoint or round trip. The CLI vendor's listener switches from HMAC verification to a lookup of tokens it issued — strictly stronger, since a token this vendor never handed out is unknown rather than merely unsigned.

Bundle artifacts authenticate with that token, scoped to the account's installed bundles. HORSIE_PLUGINS_TOKEN, the deployment-global artifact_secret, and HORSIE_ARTIFACT_SECRET are deleted. Note the boundary this adds: the route previously had no account check at all, so any account's token fetched any account's artifact.

GitHub moves to a horsie-runtime git-credential helper installed via GIT_CONFIG_* at startup, minting per operation from a new dial-token-authenticated endpoint scoped to the session's own git_checkout repos. GITHUB_TOKEN leaves the environment, and git push starts working — the old clone passed a one-shot http.extraHeader and deliberately left nothing in .git/config.

Two pre-existing bugs fixed along the way: no cloud vendor ever set the bundle base URL, so plugin bundles silently never worked on Fly or velos; and a sandboxed runtime could not exec its own binary, which the credential helper needs.

Not fixed, and worth stating: the agent's bash inherits the runtime environment, so it can read the dial token and call these endpoints itself. The trust boundary is the runtime, not the process tree. What this buys is narrower — nothing expiring in the environment, no long-lived GitHub token in it, and revocation that takes effect on the next operation rather than an hour ago.

Design and plan under docs/superpowers/.