fix: review recorded run inference access for current image

[evalstate]

Summary

• Review inference access from immutable run-recorded native configuration, without reconstructing or editing a Workbench recipe.
• Reuse valid current-image policy; otherwise explicitly approve only the current image for an unambiguous existing owned scope through the existing registry endpoint.
• Preserve actor/source/scope, policy revision, expiry, record proof, CSRF and write-mode checks. No automatic grants, replacement submission or launch.

Harbor ownership and evidence

Checked Harbor dcd0a7ac74b7bd417780d9cb27cd819c7ec82e4e: src/harbor/models/job/config.py (JobConfig validation and agents) and src/harbor/models/trial/config.py (AgentConfig, native kwargs, env, import_path, model_name, extra_allowed_hosts and environment serialization). Relevant path history includes 283ef4ee, f633b8a8, abeae607, 71180a2e, 4861de0b and later available history.

Harbor owns configuration and execution; Harbor-HF owns authenticated credential policy and console presentation. Reuses InferenceBindings.selected and the existing bounded transient review cache/approval API. No new durable schema, mirrored native field, reverse compiler, store, SQLite table or execution state. The optional run proof is ephemeral fencing, not another persisted run format. See docs/run-inference-access-review.md.

Validation

• Independent full 16-file review: GO, no HIGH/CRITICAL findings; 240 focused tests independently passed.
• Node 22.22.0: format, lint, typecheck, 1,568 unit tests, build, generated contracts and dependency audit passed, including release-head rechecks.
• 75 browser tests passed; mocked flow covers inference denial, recorded configuration, explicit approval and separate ordinary replacement submission.
• Changed modules: 97.59% lines / 91.11% branches; each of three behavioral modules exceeds 85%.
• Root Ruff, format, ty and audit passed; 102 tests, 89.10% coverage.
• Agent Ruff, format, ty and 481 tests passed. Both Dockerfiles built locally for linux/amd64.
• Public privacy, ordinary Slophammer and DRY checks passed.

Known pre-existing gaps (not bypassed or weakened)

The prescribed Slophammer --baseline invocation fails because the baseline file is absent. Whole-agent-package coverage remains approximately 77%; this change does not modify agent code. Existing native checksum deprecation and lint warnings remain. An initial browser startup probe stalled; the unchanged complete suite passed against an isolated local test server.

Release boundary

Separately authorized publication, exact green-head squash merge, matched existing image workflow and existing private control deployment. No live inference grants, credential movement, paid canary, new resource or benchmark/replacement execution. Deployment remains gated on idle execution, provenance and readiness checks. Full CI passed at exact reviewed head 8e412198561a8e53fb68a8434ffa2e3b3a0ba75c; ready for squash merge.