feat(remote): name the held lease on upload, artifact download and diagnostics requests

[V3RON]

Summary

A gateway in front of many daemons routes each request to the daemon that holds the request's lease. RPC calls already name the lease in their body, but the plain HTTP calls do not, so such a gateway cannot route them:

• uploads: POST /upload, POST /upload/preflight, PUT /upload/direct/<ticket>, POST /upload/finalize
• artifact downloads: GET /artifacts/<id>
• request diagnostics: GET /sessions/<s>/requests/<r>/diagnostics

When the client talks to a remote daemon and holds a lease, it now sends x-agent-device-lease-id: <leaseId> on these requests. This is the same lease id it puts in its RPC calls. With no lease held, it sends no header. A direct upload ticket on another origin, such as a signed storage URL, gets only the headers the daemon handed out.

Nothing reads the header yet. The daemon ignores it, and the proxy forwards only its allowlist of headers, so it drops this one. The client never sends GET /artifacts (the list), so that route is unchanged.

The wire-compat ledger gets new digests and additive acks for the changed client declarations. The stale #2946 acks on the same upload functions are dropped.

Validation

• pnpm check:affected --run: all runnable checks passed (format, lint, typecheck, layering, fallow, build, vitest-related 366 files / 2465 tests, daemon-wire-compat).
• New daemon-client-lease-header.test.ts runs sendToDaemon against a loopback remote daemon (install upload, screenshot download, failing command diagnostics). With a lease, every one of these requests carries the header. Without a lease, none does. The lease test fails when the call-site wiring is removed.
• New unit tests in upload-client, artifact-download, remote-request-diagnostics and daemon-http cover the header on each request kind, its absence without a lease, and that a foreign-origin ticket gets no header.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	5.19 MB	5.19 MB	+436 B
Package (unpacked)	5.19 MB	5.19 MB	+436 B
Package (download)	1.56 MB	1.56 MB	+84 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	26.2 ms	27.2 ms	+1.0 ms
CLI --help	76.6 ms	75.7 ms	-0.9 ms

[thymikee]

The lease header change in 0bd157d looks right to me, but Coverage fails on the test-file-size ratchet that this PR caused: src/__tests__/upload-client.test.ts grew from 988 to 1134 lines. Before merge, that file must stay at or below 988 lines. Collapse the four new lease tests into one table-driven test over {direct, legacy, foreign-origin ticket} x {lease, none} on the existing startServer helper, or move them into a lease-focused test that mirrors upload-client.ts. Smoke Tests is still queued, and its device routes do not exercise this remote HTTP header code. I did not run the new tests, and I did not inspect the wire-compat ledger digests beyond the diffstat. The direct-upload PUT and finalize lease path is covered only by the upload-client unit tests, not by the sendToDaemon loopback test.

Not blocking, and you can take or leave these: the scope headers (auth, tenant, lease) are now built by hand at six sites in upload-client.ts, artifact-download.ts and remote-request-diagnostics.ts, and the upload sites already drift because they send no tenant header while download and diagnostics do. Both new test files also hard-code x-agent-device-lease-id because DAEMON_HTTP_LEASE_HEADER is not exported like the tenant header.

Could RemoteDiagnosticsEndpoint become a shared {baseUrl, token, tenantId, leaseId} endpoint, built once per request and passed to upload, download and diagnostics, with one contracts helper that builds all scoped headers from it? That would remove the five threaded leaseId option fields and make a missing header impossible. The upload option types are internal to src/remote, so nothing has to change first.

No conflicts.