fix: preview runtime trust rotation fingerprint

web/workspace/tests/runtime-management-source.test.ts

@@ -84,6 +84,14 @@ Deno.test("Runtime detail keeps trust controls owner-only and conflict-safe", as
   const reveal = page.indexOf("Reveal public key");
   const mutation = page.indexOf('id="runtime-public-key-input"');
   assert(ownerGate >= 0, "Runtime trust controls should use manage_runtimes");
+  assert(
+    page.includes("Current fingerprint"),
+    "current fingerprint must be explicit",
+  );
+  assert(
+    page.includes("Replacement fingerprint"),
+    "replacement fingerprint must be previewed before confirmation",
+  );
   assert(
     page.includes("!runtime.management.built_in"),
     "Runtime trust controls should be hidden for the built-in Runtime",

web/workspace/tests/runtime-management.test.ts

@@ -6,6 +6,7 @@ import {
   parseRuntimeTrustConflict,
   parseWorkspaceRuntimeDetail,
   parseWorkspaceRuntimeList,
+  previewRuntimePublicKeyFingerprint,
   putRuntimeTrustKey,
   RuntimeTrustConflictError,
 } from "../src/lib/workspace/api/runtime-management.ts";
@@ -180,6 +181,17 @@ Deno.test("Runtime detail rejects unbounded strings and incoherent trust state",
   );
 });
 
+Deno.test("Runtime public key preview matches the Server fingerprint contract", async () => {
+  const fingerprint = await previewRuntimePublicKeyFingerprint(
+    "yoi-ed25519-pub:v1:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  );
+  assert(
+    fingerprint ===
+      "sha256:66687aadf862bd776c8fc18b8e9f8e20089714856ee233b3902a591d0d5f2925",
+    "fingerprint preview drifted from the Server SHA-256 contract",
+  );
+});
+
 Deno.test("typed trust conflict is validated and preserves authoritative revision", async () => {
   let sentBody: unknown = null;
   const fetchImpl = ((_: RequestInfo | URL, init?: RequestInit) => {