[maestro] Default hosted runner bind address to localhost

[haasonsaas]

Motivation

• Prevent accidental remote exposure of the Rust hosted-runner HTTP surface by changing the implicit default bind address to loopback after an unauthenticated RCE was discovered when the service was reachable on 0.0.0.0.

Description

• Change the no-env hosted-runner default from 0.0.0.0 to 127.0.0.1.
• Preserve wildcard binding for port-only deployments using PORT, MAESTRO_HOSTED_RUNNER_PORT, or port-only MAESTRO_HOSTED_RUNNER_LISTEN, so existing container ingress remains reachable unless operators opt into a host override.
• Keep explicit host env/listen values authoritative.

Internal source PR: https://github.com/evalops/maestro-internal/pull/2417

Testing

• cargo test hosted_runner_bind --lib
• cargo test resolves_env_config_with_hosted_runner_contract_names --lib
• cargo test preserves_wildcard_bind_for_port_only_hosted_runner_env --lib
• cargo test explicit_host_env_overrides_port_only_wildcard_bind --lib

Classification: Not Kyverno.

---

Codex Task

[github-actions]

This PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.

Add one of these to the PR body, then re-run the check:

• https://github.com/evalops/maestro-internal/pull/<number>
• evalops/maestro-internal#<number>
• maestro-internal#<number>

Mirrored files touched:

• packages/tui-rs/src/hosted_runner/config.rs
• packages/tui-rs/src/hosted_runner/tests.rs

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5cb20ef0e9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".