Use ephemeral worker credentials

[ariobarin]

Summary

• authenticate the durable device credential only during worker registration
• issue an opaque per-generation worker credential for poll, result, heartbeat, and unregister
• keep old CLI/new relay and new CLI/old relay compatibility through durable-device fallback
• coalesce persisted device presence updates to once per minute while keeping in-memory liveness current
• throttle stale-worker pruning and maintain O(1) active-worker counts per enrolled device
• bound presence refreshes by the relay request deadline and keep shutdown to one timeout on network failure

Stack

• based on Report incremental command progress #108; review this PR after Route command follow-ups explicitly #107 and Report incremental command progress #108

Verification

• git diff --check
• npm run check
• review loop pass 1: fixed reconnect/unregister race
• review loop pass 2: fixed stale persisted presence and per-request O(N) pruning
• review loop pass 3: fixed presence deadline and double unregister timeout
• review loop pass 4: clean ? no material correctness, security, or compatibility issues

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
glossa	Ready	Preview, Comment	Jul 27, 2026 9:20pm