chore: sync public mirror from internal

[haasonsaas]

Summary

• sync the sanitized public tree from evalops/maestro-internal
• keep evalops/maestro as a generated public mirror of the private source of truth
• preserve public-owned CI and trusted-publishing workflows from the public checkout
• internal source SHA: 52a70237140fb640270507c9fe3a64917e424de0
• last generated public sync base: 68cee999b9ee6e3d6ad9a76d6430ceb224289a21
• previewed public-tree drift: 4 file(s) to copy/update and 0 stale file(s) to delete
• public-only commits since last generated sync: 1

Source-of-truth status

Public Mirror Drift Audit

• package: @evalops/maestro
• private source: https://github.com/evalops/maestro-internal@main (52a70237140f)
• public projection: https://github.com/evalops/maestro@main (06eb62162468)
• files to copy or update: 4
• stale files to delete: 0
• result: drift detected
• invariant: public_projection_has_drift

Sample Changed Paths

• copy/update src/app-server/protocol-modes-api.ts
• copy/update src/app-server/session-api.ts
• copy/update test/app-server/protocol-modes-api.test.ts
• copy/update test/auth/totp.test.ts

Guidance

Let internal main generate and merge the public sync PR before relying on public main.

Drift sample

• copy/update src/app-server/protocol-modes-api.ts
• copy/update src/app-server/session-api.ts
• copy/update test/app-server/protocol-modes-api.test.ts
• copy/update test/auth/totp.test.ts

Public-only commits since last generated sync

• 06eb621 fix(hosted-runner): default bind to localhost ([maestro] Default hosted runner bind address to localhost #705)

Validation

• generated by the sync-public-release-mirror workflow in public-tree mode

Test Plan

• generated by the sync-public-release-mirror workflow in public-tree mode
• public-source-provenance require-internal-pr check confirms internal source PR lineage
• CI, integration, rust-hosted-conformance, coverage, Socket, and Cursor checks must pass before merge

Staged Rollout

• Staging is unnecessary for this generated mirror PR: it does not independently promote user-visible behavior. It mirrors already-reviewed internal source from evalops/maestro-internal@52a70237140fb640270507c9fe3a64917e424de0, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.

Supersedes

• updates existing generated public sync PR chore: sync public mirror from internal #735 to internal source 52a70237140fb640270507c9fe3a64917e424de0