fix(DEN-1606): bind clone build transport and identity on current dev

[ORESoftware]

Summary

Reconstruct the reviewed clone-server build transport and identity boundary directly on the current dev branch, after the atomic run-reservation merge.

This successor avoids replaying the conflicted history in #759. A same-repository one-shot finalizer applies only the reviewed transformation, runs pinned Rust formatting, warnings-denied Clippy, and every clone-server target/test, then deletes both temporary builder files and leaves exactly six product files.

Product boundary

• parse GHA_CLONE_BUILD_SERVER_URL as a credential-free origin;
• require HTTPS except loopback tests and exact Kubernetes Service DNS;
• reject credentials, query strings, fragments, non-root paths, public plain HTTP, and service-domain lookalikes;
• disable HTTP redirects on the shared clone-server client;
• require workflow bytes, jobs, steps, polling interval, execution timeout, and retained-run capacity to be strictly positive;
• reject empty, dot-segment, overlong, and path-confusing accepted build IDs;
• require every status response to return the same accepted build ID; and
• retain all atomic run-reservation behavior already merged on dev.

Tests

The finalizer runs:

cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked --all-targets -- --nocapture

The product adds unit regressions for safe/unsafe origins, exact Kubernetes DNS forms, redirect refusal, accepted ID bounds, and status identity binding, while updating real-process fixtures to use positive polling values.

Temporary files

Until the finalizer succeeds this draft contains:

• .github/workflows/den-1606-build-transport-v3-finalize-once.yml
• scripts/finalize-den-1606-build-transport.py

They are required to disappear before review. The final diff is hard-limited to the trust-boundary document, main.rs, and four existing process-test files.

Supersedes conflicted PR #759 after successful exact-head CI.

Linear: DEN-1606
Related: DEN-1635, DEN-1550, DEN-1597, DEN-1549

[linear-code]

DEN-1606