APP-4344 Propagate Oz lifecycle hook metadata through cloud workers

[warp-agent-staging]

Implements the cloud-worker portion of APP-4344 from the approved Warp specs. It transports authenticated Oz lifecycle-hook capability and project-trust metadata to the embedded runtime without adding a worker-side hook executor.

Review guide

Start with internal/types/oz_lifecycle_hooks.go for the wire validation contract, then internal/worker/worker.go for pre-claim compatibility enforcement and argv construction. The backend changes prove the same argv, workspace, credential, and cancellation boundaries across Direct, Docker, Kubernetes, and command dispatch.

What changed

• Adds strict oz_lifecycle_hooks assignment metadata with warp.oz_hook.v1 negotiation, canonical project trust identities, lowercase SHA-256 hashes, a 64-record cap, and an argv-safe 64 KiB serialized limit.
• Rejects malformed, oversized, third-party-harness, reserved-argument, and backend-incompatible assignments before task claim.
• Carries the context in TaskParams and one dedicated --oz-lifecycle-hooks-context <JSON> argv pair; hook metadata never enters the task environment or routine logs.
• Bumps command DispatchPayloadVersion to 2 and includes the non-secret context explicitly.
• Keeps hook subprocesses within task cancellation by killing Direct process groups, foreground-deleting Kubernetes Jobs, and requiring a command-backend cancel command before accepting hook-enabled tasks.
• Leaves unhooked third-party harness and command-backend assignments unchanged.

Validation

• go test ./internal/worker -run 'TestCommandBackendLifecycleHooksRequireCancelCommand|TestSanitizeArgsForLog' -count=1
• test -z "$(gofmt -s -l .)"
• go vet ./...
• go test ./internal/worker/...
• go test ./...
• go build ./...
• golangci-lint run --new-from-rev=origin/main — 0 issues
• git diff --check

The unscoped golangci-lint run still reports five existing findings on untouched lines: three errcheck findings in internal/worker/worker_test.go and two staticcheck findings in internal/worker/kubernetes_setup_events.go.

Landing order

Land after the protocol definitions, MAA server gates, and Warp embedded-runtime/CLI consumer. This worker PR is the fourth cross-repository step because current embedded binaries do not accept --oz-lifecycle-hooks-context.

[warp-agent-staging]

This PR was generated with Warp.

Comment @warp-staging-factory on this PR to send it follow-up work.