418: [factory] Canary — post-JIT-fixes verify

[agent-relay-code]

Canary — post-JIT-fixes verify (full end-to-end)

Proves the full JIT path is live end-to-end after the ship of:

• cloud#3214 — widen fleet-provisioning gate to accept source: "relayfile" bearers
• cloud#3218 — replace scope check with signed-identity match (sub === 'agent_agent-relay-factory' AND wks === 'rw_7ccfea89')
• cloud#3219 — revert cloud#3216 (mint-side scope now dead)
• cloud#3215 — flush-failure fatal (Fix B)
• relaycast#360 — tag preservation (Fix C)
• factory-cloud#82 — closed (grant-side scope obsolete under identity auth)

Expected path

1. factory sweep picks this issue up (labels: factory, factory-ready, agent:single).
2. RelayFleetClient.spawn() invokes the provisionSandbox hook.
3. container/sandbox-provisioner.mjs POSTs to /cloud/api/v1/fleet/nodes/sandbox/ensure with repos: ["AgentWorkforce/factory"].
4. Cloud's requireFleetProvisioningAuth/isFleetProvisioningServiceAuth admits the factory JWT by signed identity (not by scope).
5. Cloud provisions a fresh Daytona sandbox, mounts Relayfile, clones the repo into /srv/agent-workforce/factory.
6. The enrolled sandbox comes online with a cloud:node-type:*-jit tag (visible in query_nodes).
7. Placement lands the spawn on that node.
8. Broker resolves worker_cwd: /srv/agent-workforce/factory, cds into the fresh clone, spawns the harness.
9. Agent opens a branch, drafts a PR, and posts a writeback comment back to this issue (kjgbot).

Definition of done

• New cloud:node-type:*-jit node appears in query_nodes when dispatch fires
• A factory-app-authored branch/PR is opened against AgentWorkforce/factory for this canary
• kjgbot writeback comment lands on this issue linking the PR
• No readinessReconcile stall; step metadata stepStatus.error field is either absent or well-formed (no wedge)

Trivial task for the agent

Append one line to README.md:

Canary — post-JIT-fixes verify — <ISO-8601 timestamp>

Open a PR titled chore: post-JIT-fixes canary targeting main. Don't merge — leaving the PR open is the signal.

Fixes #418

---

Summary by cubic

Adds a canary timestamp line to README.md to verify the post-JIT-fix factory provisioning path works end-to-end.

This PR is the agent's writeback for the canary: sweep, sandbox provisioning, clone, harness spawn, and PR creation all completed successfully. Leaving the PR open signals the pipeline is healthy.

Fixes #418.

^{Written for commit f3cbd64. Summary will update on new commits.}

[github-actions]

@coderabbitai review

Requested for exact head f3cbd6439854c5d1bcb5e0861313c95198f7f9c1.