fix: align runtime trust schema and built-in controls

crates/workspace-server/src/latest_schema.sql

@@ -440,7 +440,7 @@ CREATE TABLE workspace_runtime_bindings (
     base_url TEXT NOT NULL,
     public_key TEXT NOT NULL,
     public_key_fingerprint TEXT NOT NULL,
-    binding_revision INTEGER NOT NULL CHECK (binding_revision > 0),
+    binding_revision INTEGER NOT NULL DEFAULT 1 CHECK (binding_revision > 0),
     created_at TEXT NOT NULL,
     updated_at TEXT NOT NULL,
     revoked_at TEXT,

crates/workspace-server/src/store.rs

@@ -6470,6 +6470,17 @@ fn verify_workspace_runtime_binding_schema(conn: &Connection) -> Result<()> {
             "workspace_runtime_bindings schema does not match schema-52".to_string(),
         ));
     }
+    let revision_default = conn.query_row(
+        "SELECT dflt_value FROM pragma_table_info('workspace_runtime_bindings') WHERE name = 'binding_revision'",
+        [],
+        |row| row.get::<_, Option<String>>(0),
+    )?;
+    if revision_default.as_deref() != Some("1") {
+        return Err(Error::Store(
+            "workspace_runtime_bindings binding_revision default does not match schema-52"
+                .to_string(),
+        ));
+    }
     let sql = conn.query_row(
         "SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'workspace_runtime_bindings'",
         [],

web/workspace/src/routes/w/[workspaceId]/settings/runtimes/[runtimeId]/+page.svelte

@@ -219,7 +219,7 @@
       {/if}
     </section>
 
-    {#if data.workspace.permissions.manage_runtimes}
+    {#if data.workspace.permissions.manage_runtimes && !runtime.management.built_in}
       <section class="runtime-detail-section" aria-labelledby="runtime-trust-heading">
         <h2 id="runtime-trust-heading">Workspace trust</h2>
 

web/workspace/tests/runtime-management-source.test.ts

@@ -84,6 +84,10 @@ Deno.test("Runtime detail keeps trust controls owner-only and conflict-safe", as
   const reveal = page.indexOf("Reveal public key");
   const mutation = page.indexOf('id="runtime-public-key-input"');
   assert(ownerGate >= 0, "Runtime trust controls should use manage_runtimes");
+  assert(
+    page.includes("!runtime.management.built_in"),
+    "Runtime trust controls should be hidden for the built-in Runtime",
+  );
   assert(
     ownerGate < reveal && ownerGate < mutation,
     "owner gate should wrap key controls",