fix(serve): keep a public endpoint authenticated across respawns

[volen-silo]

• If this PR fixes a bug, searched tests/e2e-cucumber/expectations.toml for the fixed ticket ID and removed/narrowed any now-stale xfail rows. (No EAI-7409 rows exist; endpoint auth has never had e2e coverage.)

Problem

Public-endpoint authentication (EAI-7409, added in #124) held for the initial rocm serve, but not for any path that respawns a recorded service. Those paths treated "a key file exists" as the source of truth. The real invariant is a property of the recorded host: a non-loopback bind must always be authenticated.

Reachable through first-class commands:

rocm serve --host 0.0.0.0 --allow-public-bind   # key minted, stored 0600, printed
rocm services stop <id>                         # key file deleted
rocm services restart <id>                      # comes back with NO key

restart_internal_managed_service captured None for the preserved key, stored nothing, and spawned the engine child with no ROCM_SERVE_API_KEY_FILE, so the service returned on 0.0.0.0 completely unauthenticated. rocm services restart documents its argument as an id from rocm services list --all, which includes stopped records, so this is the documented flow rather than an edge case. rocmd's recovery supervisor had the same gap.

Approach

Enforce the invariant at each spawn site and fail closed, following the existing ensure_public_bind_engine_supported precedent. Fail-closed rather than mint-and-print a replacement key: restart_server is also an automation/sandbox tool whose JSON result can land in agent transcripts, so regenerating would add a secret-disclosure surface.

• rocm_engine_protocol::is_public_bind_host is now the single classification, so rocm and rocmd cannot disagree about a recorded host. Both crates' is_loopback_host delegate to it.
• Refuse a keyless public respawn in restart_internal_managed_service (before the stop, so a refused restart leaves a running service running), in spawn_managed_engine_child, and in rocmd's supervise_service (before the manifest write, so a refusal does not clobber restart_count/timestamps).
• The guards check key validity, not file existence — the engine adapters resolve the key with endpoint_api_key_from_file and enforce nothing when it yields None, so an empty file would otherwise pass the guard and still serve anonymously.
• A stop drops the key only once it has confirmed termination. An unconfirmed stop may have left the engine alive and still enforcing the key, and discarding the only copy locked the CLI's own probes, chat, and discovery out of a healthy service. The deferred cleanup lands on the liveness refresh that later observes the process dead, so no plaintext secret is stranded.
• Daemon recovery refuses at the recovery boundary with a recorded restart_managed_service_refused event, rather than letting a permanent failure propagate out of evaluate_watchers and take every watcher down on each 30s tick.

Loopback behavior is unchanged: it stays credential-free.

Behavior change

A public-host service whose key is gone (including records predating #124) is no longer restartable in place; relaunch it with rocm serve --host <host> --allow-public-bind to issue a new key. The refusal message says so. This is the intended cost of fail-closed.

Known gap

rocmd's own stop_managed_service still clears the key unconditionally: its terminate_process reports only that a signal was accepted, so it has no confirmed-termination notion to gate on. Giving it one is a larger change than this fix.

Testing

cargo fmt --all -- --check and cargo clippy --workspace --all-targets -- -D warnings clean. cargo test --workspace --no-fail-fast passes except two pre-existing rocm-core proc_lifecycle::tests::tree_* failures, which fail on WSL2 for process-tree signalling reasons unrelated to this change (untouched file).

Not run locally: GPU acceptance (scripts/vllm_therock_gpu_test.py) and the GPU e2e lanes — no GPU on this host. The end-to-end assertion that a restarted public server actually rejects an unauthenticated request needs a live engine; endpoint auth has no e2e coverage today, so these paths are unit-tested only. Filters are listed in docs/testing.md.

Closes EAI-7409.