feat: add manual Runtime trust setup UI

web/workspace/tests/runtime-management.test.ts

@@ -39,6 +39,13 @@ function runtime() {
       removable: false,
       endpoint_configured: true,
       token_ref_configured: false,
+      binding: {
+        state: "verified",
+        authentication_mode: "workspace_identity",
+        revision: 3,
+        workspace_key_id: "WK-1",
+        workspace_key_generation: 1,
+      },
     },
     runtime_id: "arcadia",
     label: "Arcadia",
@@ -95,6 +102,11 @@ Deno.test("Runtime list and detail parsers return generated Runtime DTO shapes",
     "Runtime ID was not preserved",
   );
 
+  assert(
+    list.items[0]?.management.binding?.state === "verified",
+    "binding state was not preserved",
+  );
+
   const parsed = parseWorkspaceRuntimeDetail(detail());
   assert(
     parsed.trust_key.revision === 3,
@@ -106,6 +118,20 @@ Deno.test("Runtime list and detail parsers return generated Runtime DTO shapes",
   );
 });
 
+Deno.test("Runtime management parser rejects Workspace identity bindings without key metadata", () => {
+  const payload = detail();
+  const binding = payload.runtime.management.binding as Partial<
+    typeof payload.runtime.management.binding
+  >;
+  delete binding.workspace_key_id;
+  delete binding.workspace_key_generation;
+  binding.state = "configured";
+  assertThrows(
+    () => parseWorkspaceRuntimeDetail(payload),
+    "requires Workspace signing key identity metadata",
+  );
+});
+
 Deno.test("Runtime validators reject unknown object keys and enum variants", () => {
   assertThrows(
     () => parseWorkspaceRuntimeDetail({ ...detail(), head_tree: "stale" }),