feat(worker): enforce durable trust state

internal/distworker/client.go

@@ -122,6 +122,25 @@ func (c *Client) RotateToken(ctx context.Context) (string, error) {
 	return out.AuthToken, nil
 }
 
+func (c *Client) Bootstrap(ctx context.Context, workerID, token string) (wire.BootstrapResponse, error) {
+	var out wire.BootstrapResponse
+	resp, err := c.postJSONContext(ctx, "/api/internal/workers/bootstrap", wire.BootstrapRequest{WorkerID: workerID, BootstrapToken: token})
+	if err != nil {
+		return out, err
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode != http.StatusOK {
+		return out, checkStatusCode(resp, "bootstrap")
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return out, err
+	}
+	if out.AuthToken == "" || out.WorkerID != workerID || out.ConfigVerificationKey == "" {
+		return out, fmt.Errorf("invalid bootstrap response")
+	}
+	return out, nil
+}
+
 // GetJobs fetches available check jobs from the control plane
 func (c *Client) GetJobs() (*wire.JobsResponse, error) {
 	httpReq, err := http.NewRequest("GET", c.endpoint+"/api/internal/workers/jobs", http.NoBody)