CL-7274: document run-key-history's exclusive-allocation gap

[TheGreatAxios]

Summary

Investigation lane for CL-7274. Traced every write to workflow_run.public_key across vendor/intx and checked each against whether packages/run-key-history/src/listener.ts observes a corresponding agent.deploy.ack.

Confirmed live correctness gap, not just a boundary concern: every exclusive-allocation deploy rotates workflow_run.public_key through a path run-key-history never sees.

• vendor/intx/hub-sessions/src/ws/sidecar-handler.ts:3070-3094 (handleDeployAck) stamps allocated: {...} onto every agent.deploy.ack for a connection whose identity is "allocated".
• vendor/intx/hub-sessions/src/session-service.ts:1812-1872 (updateAnchorPublicKeyUnderAllocationLock) reads that ack's publicKey and writes it onto workflow_run unconditionally — it has no allocated guard of its own.
• Both hub-session-orchestrator.ts:101 and run-key-history's own listener.ts:49 skip recording that same ack because it carries allocated — a guard whose own doc comment assumes vendor "skips its own workflow_run update for the same ack," which is not what the code does: vendor writes it through a separate, non-event-gated path.
• This is wired live in production: apps/hub/src/index.ts runs both listeners off the same sidecarRouter.events emitter, and its 1s allocation-reconciliation loop drives workflow-allocation-service.ts:387's deployReadyAllocation → deployPreparedCodeSourcedWorkflow for every exclusive-allocation deploy and every post-failure allocation replacement (sidecar-allocation-store.ts:620-631's beginReplacement nulls the key first, then this re-stamps it).

Net effect: run-key-history never records a key for any exclusive-allocation-deployed workflow run — not the first deploy, not any later rotation. This is the dedicated-capacity/"run this workbench on its own sidecar" product path, not dead vendor code.

Other rotation paths checked and found sound (observed correctly):

• deployCodeSourcedWorkflow (shared capacity, session-service.ts:1030)
• deployAdoptedCodeSourcedWorkflow (shared capacity, used by folded runs, session-service.ts:1088)

Changes

• packages/run-key-history/test/listener.test.ts: added a test.failing that models vendor's independent write to workflow_run.public_key alongside the listener, and asserts the listener should have recorded it. It fails today (as expected, keeping CI green via test.failing) — flip it to a plain test once the fix or the upstream ruling lands.

Not done here (out of scope for this lane)

• No fix — this is the correctness-diagnosis pass CL-7274 asked for first.
• The upstream-adoption assessment (native surface vs. package) is a separate follow-up once this gap is resolved or accepted.

Test plan

• bun test packages/run-key-history/test/listener.test.ts — 4 pass (the new test passes via test.failing)
• bunx tsc --noEmit -p packages/run-key-history/tsconfig.json
• prettier --check / eslint on the changed file