fix: align isolated runtime harness with current trust contract

Keep Workspace trust enrollment and owner-authenticated registration, then verify each Runtime connection with a fresh signed request and match its binding ID. Remove obsolete workspace_trust_id input and cached connection_state assertions.

Validation: cargo test -p yoi-e2e --features e2e --test worker_environment --test auth_passkeys -- --nocapture (2 Runtime harness tests and 1 Passkey product E2E passed); root cargo check.

tests/e2e/src/worker_environment.rs

@@ -439,7 +439,14 @@ impl WorkerE2eEnvironment {
             false,
         )?;
         let enrollment: Value = serde_json::from_slice(&enrollment.stdout)?;
-        let workspace_trust_id = json_string(&enrollment, "/trust_id")?;
+        if json_string(&enrollment, "/trust_id")?.is_empty()
+            || enrollment.get("workspace_id").and_then(Value::as_str) != Some(workspace_id.as_str())
+            || enrollment.get("state").and_then(Value::as_str) != Some("active")
+        {
+            return Err(HarnessError::Protocol(
+                "Runtime did not retain active trust for the fixture Workspace".to_string(),
+            ));
+        }
 
         let mut command = self.isolated_command(&runtime_binary);
         command.args([
@@ -468,12 +475,20 @@ impl WorkerE2eEnvironment {
                 .post(format!("{server_url}/api/w/{workspace_id}/runtimes"))
                 .json(&serde_json::json!({
                     "public_bundle": runtime_identity,
-                    "workspace_trust_id": workspace_trust_id,
                     "display_name": format!("E2E {}", self.runtime_id),
                     "endpoint": runtime_url
                 })),
             "register Runtime",
         )?;
+        self.assert_connected_and_empty()?;
+        self.write_metadata("running")?;
+        Ok(())
+    }
+
+    pub fn assert_connected_and_empty(&self) -> Result<()> {
+        let server_url = self.required_server_url()?;
+        let workspace_id = self.required_workspace_id()?;
+        // connection testは実署名要求。保存済みの接続flagを認証成功の代わりにしない。
         let connection = self.request_json(
             self.client.post(format!(
                 "{server_url}/api/w/{workspace_id}/runtimes/{}/connection-tests",
@@ -486,14 +501,7 @@ impl WorkerE2eEnvironment {
                 "Runtime connection was not compatible: {connection}"
             )));
         }
-        self.assert_connected_and_empty()?;
+        let binding_id = json_string(&connection, "/binding_id")?;
-        self.write_metadata("running")?;
-        Ok(())
-    }
-
-    pub fn assert_connected_and_empty(&self) -> Result<()> {
-        let server_url = self.required_server_url()?;
-        let workspace_id = self.required_workspace_id()?;
         let runtimes = self.request_json(
             self.client
                 .get(format!("{server_url}/api/w/{workspace_id}/runtimes")),
@@ -506,9 +514,9 @@ impl WorkerE2eEnvironment {
                 items.iter().any(|item| {
                     item.get("runtime_id").and_then(Value::as_str) == Some(self.runtime_id.as_str())
                         && item
-                            .pointer("/management/binding/connection_state")
+                            .pointer("/management/binding/binding_id")
                             .and_then(Value::as_str)
-                            == Some("verified")
+                            == Some(binding_id.as_str())
                 })
             });
         if !connected {