[Compute Separation][HT9] Expose the one-worker link and acceptance endpoint

[brettsam]

Roadmap mapping

Field	Value
Roadmap ID	HT9
Lane	Host
BYOC milestone	M1
Parent	#11965
Depends on	HT4, HT8b, HT13 / #11971
Blocks	HT10-M1+HT13B-M1
Pull request	One PR

Why this PR exists

Everything before HT9 can only be driven inside the process. The platform must link a worker through an HTTP route. This PR adds one compute-only thin adapter translating the frozen HT13 request into one HT4 registry link and returning definitive acceptance after handshake/registration.

Source material

• platform-control-apis.md, worker linking.
• ga-plan.md, link contract and compute-only DTO boundary.
• Roadmap HT9 and incremental link/control milestone.
• HT13 / [Compute Separation][HT13] Freeze the M1 Host, appserver, and nginx contract #11971.
• internal BYOC #117 operation/epoch replay and internal BYOC #219.
• Prototype WorkerController/ExternalWorkerInfo are validation/status references only; do not port placement, standby branch, or old connection manager.

Current state

HT4 links internally; HT8b starts ScriptHost on first completed link; compute executable exists. No external route, DTO, validation, status mapping, replay handling, or acceptance event exists. Standard Host must remain route-free.

Proposed implementation

1. Confirm method/route/payload/status/replay/acceptance marker in HT13 before merge.
2. Add compute-owned WorkerLinkRequest/response DTOs only in compute product; never shared Grpc/Server/Script/standard WebHost.
3. Map the route from compute composition using minimal APIs or compute-only MVC application part. Record choice and prove standard route absence.
4. Validate missing/blank identity, missing body, route/body mismatch, and invalid gRPC/HTTP endpoints with deterministic 400. Use ordinal identifier comparison.
5. Apply internal BYOC #117 admission/replay rules: exact replay idempotent; stale/conflicting/terminal admission rejected without mutation; failed removed entry retryable as frozen by HT13.
6. Translate to HT4 WorkerLinkContext, call LinkAsync, honor request cancellation, and return success only after connection, StartStream, init handshake, and channel registration—not ScriptHost/capacity completion.
7. Map connection/unavailable versus admission/state failures to HT13 status codes and leave no orphaned entry.
8. Emit exact structured acceptance/rejection event with worker ID, operation/epoch, reason, and elapsed time for internal BYOC #219 evidence.

Ownership and lifecycle

Endpoint owns translation/validation/status/replay adapter only. Registry owns channels; HT8b owns ScriptHost startup. Root compute services expose route across ScriptHost restarts. Registry provides same-worker serialization; endpoint adds no competing lock.

Tests and evidence

• happy link via test server -> success, ready registry entry, HT8b observes first link;
• complete validation ladder;
• exact/stale/conflicting/terminal replay matrix;
• unreachable endpoint -> unavailable, no leaked entry, later retry succeeds;
• cancellation mid-link cleans resources;
• exact acceptance/rejection event fields;
• standard route table has no worker-link route and shared assemblies contain no DTO;
• HT14 service graph/publish/deps/startup evidence.

Explicit exclusions

No list/status/query, unlink/drain/stop/eviction/reconnect, capacity/slots/runtime-state, auth/key enforcement, specialization/Standby, host.json/link config, standard controller changes, multi-worker admission, billing, extension gRPC, or assembly streaming.

Acceptance criteria

• Frozen compute route links one worker and succeeds only after handshake/registration.
• Validation and replay semantics are deterministic and non-mutating on failure.
• Unavailable maps correctly and leaves retryable state.
• Acceptance event matches contract.
• Route/DTO are absent from standard/shared products.

PR stop condition

Stop when the compute-only link endpoint fully implements HT13/internal BYOC #117 acceptance/replay semantics and is provably absent from standard Host. Do not add unlink/drain/status, auth, or capacity.