feat(werkbank): runner queue endpoints + result persistence (WB-05)

The control-plane side of the pull API (implements sharang/werkbank#6), so a
Werkbank runner can reach a real queue end-to-end:

- POST /api/v1/werkbank/jobs/{lease,heartbeat,complete} — thin handlers over the
  JobQueue (WB-02), tenant-scoped from the request's `tenant` (db_pool
  .for_tenant_id). lease→204 when empty; heartbeat→409 on a lost lease.
- Machine auth: a static WERKBANK_RUNNER_TOKEN bearer (require_runner_token),
  mounted only when the token is set — like the admin API, and NOT a Keycloak JWT
  (a runner acts across tenants). /api/v1/werkbank/* is added to the JWT
  PUBLIC_PREFIXES so it routes to the runner-token gate, not the customer-JWT one.
- On completion, the runner's findings + DAST findings are persisted against the
  job's target (dedup'd by fingerprint), so a job run by a remote runner lands
  the same findings an in-process run would.
- Shared transport types (LeaseRequest/HeartbeatRequest/CompleteRequest/
  CompleteResponse) live in compliance-core so the runner (client) and control
  plane (server) agree on shapes.

Tests: 3 HTTP integration tests against a live Mongo (lease→complete→persist,
empty-queue 204, and the bearer-token gate) + a token-compare unit test. Skips
cleanly with no Mongo. clippy + fmt clean.

Follow-up: wiring the scan pipeline to enqueue plc-provision jobs needs an
artifact-fetch path for the runner (so it can pull the program blob); tracked
with the on-prem work.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance-agent/tests/common/mod.rs

@@ -2,6 +2,10 @@
 //
 // Spins up the agent API server on a random port with an isolated test
 // database. Each test gets a fresh database that is dropped on cleanup.
+//
+// Included via `mod common;` in several test binaries; not every binary uses
+// every helper, so allow dead code here.
+#![allow(dead_code)]
 
 use std::sync::Arc;
 
@@ -11,6 +15,54 @@ use compliance_agent::database::DatabasePool;
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
+/// The runner bearer token wired into the test config.
+pub const TEST_RUNNER_TOKEN: &str = "test-runner-token";
+
+/// A minimal dev [`AgentConfig`] for tests: unauthenticated (no Keycloak), the
+/// Werkbank runner API enabled with [`TEST_RUNNER_TOKEN`].
+pub fn dev_config(mongodb_uri: String, db_name: String) -> AgentConfig {
+    AgentConfig {
+        mongodb_uri,
+        mongodb_database: db_name,
+        litellm_url: std::env::var("TEST_LITELLM_URL")
+            .unwrap_or_else(|_| "http://localhost:4000".into()),
+        litellm_api_key: SecretString::from(String::new()),
+        litellm_model: "gpt-4o".into(),
+        litellm_embed_model: "text-embedding-3-small".into(),
+        agent_port: 0, // not used — we bind ourselves
+        scan_schedule: String::new(),
+        cve_monitor_schedule: String::new(),
+        git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
+        artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
+        ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
+        github_token: None,
+        github_webhook_secret: None,
+        gitlab_url: None,
+        gitlab_token: None,
+        gitlab_webhook_secret: None,
+        jira_url: None,
+        jira_email: None,
+        jira_api_token: None,
+        jira_project_key: None,
+        searxng_url: None,
+        nvd_api_key: None,
+        keycloak_url: None,
+        keycloak_realm: None,
+        keycloak_admin_username: None,
+        keycloak_admin_password: None,
+        pentest_verification_email: None,
+        pentest_imap_host: None,
+        pentest_imap_port: None,
+        pentest_imap_tls: false,
+        pentest_imap_username: None,
+        pentest_imap_password: None,
+        admin_api_token: None,
+        tenant_registry_url: None,
+        plc_runtime: compliance_core::PlcRuntimeConfig::default(),
+        werkbank_runner_token: Some(SecretString::from(TEST_RUNNER_TOKEN.to_string())),
+    }
+}
+
 /// A running test server with a unique database.
 pub struct TestServer {
     pub base_url: String,
@@ -33,45 +85,7 @@ impl TestServer {
             .await
             .expect("Failed to build DatabasePool");
 
-        let config = AgentConfig {
-            mongodb_uri: mongodb_uri.clone(),
-            mongodb_database: db_name.clone(),
-            litellm_url: std::env::var("TEST_LITELLM_URL")
-                .unwrap_or_else(|_| "http://localhost:4000".into()),
-            litellm_api_key: SecretString::from(String::new()),
-            litellm_model: "gpt-4o".into(),
-            litellm_embed_model: "text-embedding-3-small".into(),
-            agent_port: 0, // not used — we bind ourselves
-            scan_schedule: String::new(),
-            cve_monitor_schedule: String::new(),
-            git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
-            artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
-            ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
-            github_token: None,
-            github_webhook_secret: None,
-            gitlab_url: None,
-            gitlab_token: None,
-            gitlab_webhook_secret: None,
-            jira_url: None,
-            jira_email: None,
-            jira_api_token: None,
-            jira_project_key: None,
-            searxng_url: None,
-            nvd_api_key: None,
-            keycloak_url: None,
-            keycloak_realm: None,
-            keycloak_admin_username: None,
-            keycloak_admin_password: None,
-            pentest_verification_email: None,
-            pentest_imap_host: None,
-            pentest_imap_port: None,
-            pentest_imap_tls: false,
-            pentest_imap_username: None,
-            pentest_imap_password: None,
-            admin_api_token: None,
-            tenant_registry_url: None,
-            plc_runtime: compliance_core::PlcRuntimeConfig::default(),
-        };
+        let config = dev_config(mongodb_uri.clone(), db_name.clone());
 
         let agent = ComplianceAgent::new(config, db_pool);