feat: guarded Worker Restore from shared Web actions (T-701)

crates/protocol/src/subscription.rs

@@ -651,6 +651,10 @@ impl SubscriptionWorkerJob {
 #[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
 #[cfg_attr(feature = "json-schema", derive(schemars::JsonSchema))]
 pub struct SubscriptionWorker {
+    /// Opaque Runtime-owned Restore observation identity, never a display-state hash.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "typescript", ts(optional = nullable))]
+    pub restore_observation_token: Option<String>,
     pub worker_id: SubscriptionWorkerId,
     /// Set by the Workspace Server when projecting a Runtime-owned Worker to clients.
     /// Runtime producers leave this unset because the connection identifies the Runtime.
@@ -689,6 +693,9 @@ pub struct SubscriptionWorker {
 impl SubscriptionWorker {
     pub fn validate(&self) -> Result<(), SubscriptionValidationError> {
         self.worker_id.validate()?;
+        if let Some(token) = &self.restore_observation_token {
+            validate_identifier("restore_observation_token", token, MAX_RESOURCE_ID_BYTES)?;
+        }
         if let Some(runtime_id) = &self.runtime_id {
             validate_identifier("runtime_id", runtime_id, MAX_RESOURCE_ID_BYTES)?;
         }
@@ -962,6 +969,7 @@ mod tests {
 
     fn worker(value: &str) -> SubscriptionWorker {
         SubscriptionWorker {
+            restore_observation_token: None,
             worker_id: worker_id(value),
             runtime_id: None,
             resource_key: None,

crates/protocol/src/typescript.rs

@@ -246,6 +246,7 @@ fn rust_serialized_subscription_frame_fixtures() -> Vec<SubscriptionFrame> {
     let external_workdir_id = SubscriptionWorkdirId::new("fixture-external-workdir")
         .expect("fixture external Workdir id must be valid");
     let worker = SubscriptionWorker {
+        restore_observation_token: Some("fixture-restore-observation".into()),
         worker_id: worker_id.clone(),
         runtime_id: Some("fixture-runtime".to_string()),
         resource_key: Some("fixture-worker-resource".to_string()),

crates/protocol/src/typescript_validator_template.ts

@@ -378,6 +378,7 @@ function validateWorkers(workers: SubscriptionWorker[]): boolean {
 }
 
 function validateWorker(worker: SubscriptionWorker): boolean {
+  if (worker.restore_observation_token != null && !validateIdentifier(worker.restore_observation_token, MAX_RESOURCE_ID_BYTES)) return false;
   if (!validateIdentifier(worker.worker_id, MAX_RESOURCE_ID_BYTES)) return false;
   if (worker.runtime_id != null && !validateIdentifier(worker.runtime_id, MAX_RESOURCE_ID_BYTES)) {
     return false;