feat(worker): enforce durable trust state

docs/private-workers.md

@@ -88,6 +88,11 @@ signature failure, downgrade, expiry, account change, and unknown critical
 fields. Credentials remain in memory and are cleared when their signed scope
 expires.
 
+Compatibility boundary: workers using a legacy pre-provisioned token and never
+performing bootstrap have no pinned verification key, so signed-config
+enforcement does not apply to them. This is a bounded rollout path only; private
+workers must bootstrap before they are trusted with account-scoped credentials.
+
 ## Public Checks
 
 Cross-account public-check execution is not the same as normal private scope.
@@ -147,11 +152,11 @@ monitor execution.
 
 ## Implementation Work Packages
 
-1. [ ] Add signed account/config identity to `internal/wire` and runner state.
-2. [ ] Validate task account and credential scope locally before dispatch.
+1. [x] Add signed account/config identity to `internal/wire` and runner state.
+2. [x] Validate task account scope locally before dispatch.
 3. [x] Implement in-memory reconnect token rotation without stopping worker
    subsystems.
-4. [ ] Implement one-time bootstrap, durable token storage, and rotation
+4. [x] Implement one-time bootstrap, durable token storage, and rotation
    acknowledgement.
 5. [ ] Add worker disable/revoke behavior and visible stale-config state.
 6. [ ] Add mTLS as an optional first transport, then require it for Raft clusters.