fix(plugin-workers): derive trigger id from {id} path, fail loudly on missing id (#279)

[rickylabs]

Summary

Fixes the one still-open correctness gap from the eis-chat plugin-workers dogfood (#279 Gap 2), extended symmetrically to the sibling triggerTask.

Gap 2 — triggerJob/triggerTask took the id from the request BODY, not the {id} path. The OpenAPI route is POST /jobs/{id}/trigger, but the input schema required id in the body and the created task's id was read from the body — so an empty-body call persisted a task with id=undefined silently (Processing task 'undefined' then Workers KV key contains unsupported part: undefined), leaving the caller with no error. This makes the path {id} the single source of truth and fails loudly when the resolved id is missing.

Change

• packages/plugin-workers-core/src/contracts/v1/workers.contract-schemas.ts + workers.contract-types.ts — id made optional in JobTriggerInputZodSchema and TaskTriggerInputZodSchema (oRPC merges the OpenAPI {id} path param into input.id). Backward compatible: callers that still send a body id round-trip unchanged.
• plugins/workers/services/src/routers/jobs.ts + tasks.ts — resolve the id from the path and call validationFailed(...) (VALIDATION_ERROR) before any KV write when the id is missing/empty; no path can persist id=undefined.
• packages/contracts/src/domain/errors.ts + public/mod.ts (+ test) — new centralized validationFailed helper (mirrors the existing notFound; single sanctioned contract-boundary cast, returns never so the id narrows to string).
• plugins/workers/services/src/trigger-path-id_test.ts — regression for both procedures: empty-body POST resolves the id from the path (never undefined); missing id fails loudly.
• packages/sdk/tests/integration/workers-trigger-rpc_test.ts — Gap 1 guard: proves the typed createServiceClient RPC transport reaches triggerJob on a real mounted plugin service (see below).

The other four gaps in #279 were already resolved on main

Triage (grounded on origin/main) found the framework had already landed the fixes for the rest — this PR closes the remainder:

• Gap 1 (plugin service exposes OpenAPI but not RPC, so createServiceClient 404s): already fixed — createPluginService mounts withRPC and wireRpc serves both /api/rpc/* and /api/* (Re-architect plugin scaffold surface (#157): thin, typesafe, no plugin-source copy #172). Added a regression guard test rather than a code change; no residual 404.
• Gap 3 (consumer jobs not auto-registered): fixed by workers: service->plugin-API discovery + workers-api not loading user jobs (Aspire wiring gaps) #217/fix(workers): wire Service→plugin-API discovery + load user jobs in workers-api (#217) #220 (registerGeneratedJobDefinitions + compileWorkersRegistry discovery).
• Gap 4 (a Service can't declare ServiceReferences/PluginReferences): fixed by workers: service->plugin-API discovery + workers-api not loading user jobs (Aspire wiring gaps) #217/fix(workers): wire Service→plugin-API discovery + load user jobs in workers-api (#217) #220 (config service-schema.ts + wireServiceReferences).
• Gap 5 (--allow-ffi for native DB drivers): already present in the workers Aspire contribution. The remaining single-writer guidance is documentation (out of scope here).

Validation

CI quality trio (fmt/lint/check --unstable-kv) clean over the 4 touched roots; touched tests 6 passed / 0 failed; deno publish --dry-run on plugin-workers-core and contracts both succeed with no --allow-slow-types. Independently reproduced by a separate-session evaluator (PASS). The PR CI runs the scaffold gates (the PR-only scaffold authority).

Fixes #279. Removable eis-chat workaround: the { id: jobId, ... } body-id send in services/eischat/src/jobs.ts (eis-chat PR #83) is no longer needed once this lands.