feat(worker): adopt canonical public URL

docs/control-plane-protocol.md

@@ -46,9 +46,9 @@ without execution or reporting.
 
 ## Initialization And Refresh
 
-The worker proposes `PUBLIC_URL` during registration. The control plane
-validates and canonicalizes it; `wire.WorkerInit` returns the accepted endpoint
-and supplies runtime values owned by the control plane:
+The worker is expected to propose `PUBLIC_URL` during registration and the
+control plane to validate and canonicalize it; `wire.WorkerInit` returns the
+accepted endpoint and supplies runtime values owned by the control plane:
 
 - worker ID, region, advertised URL, capabilities, and concurrency;
 - allowed notification methods and account IDs;
@@ -57,6 +57,12 @@ and supplies runtime values owned by the control plane:
 - scoped notification credentials and system contacts;
 - signed, cluster-scoped peer topology for selfcheck and Raft behavior.
 
+Current worker behavior: the worker validates its local `PUBLIC_URL`
+configuration at startup and *consumes* the accepted endpoint from
+`wire.WorkerInit` (preferring `public_url`, falling back to the legacy `url`
+field). Transmitting the proposed URL during registration is the pending RSMon
+control-plane counterpart; the worker does not currently send it.
+
 Worker ID, account, region, cluster, membership, role, topology generation, and
 certificate identity are control-plane authority. Local environment or a peer
 response cannot override them. Static peer environment remains lab-only.
@@ -65,6 +71,14 @@ The worker clamps supplied concurrency to its local maximum. Credentials are
 replaced atomically in memory on refresh. Removed credentials must become
 unavailable immediately after the refresh is applied.
 
+`wire.WorkerInit` returns the accepted endpoint as `public_url`, with the
+legacy `url` field still populated during the bounded migration; the worker
+prefers `public_url` and ignores an unusable value (keeping the previous
+accepted URL). `RegisterRequest.public_url` is the registration contract the
+RSMon control-plane counterpart must populate when it wires worker-initiated
+registration; the worker does not transmit it today. See
+[public-endpoint-and-identity.md](public-endpoint-and-identity.md).
+
 Private-worker hardening will add an immutable worker account ID, config
 version, expiry, and signature. Until then the executable trusts the
 authenticated control plane to send a correctly scoped config; server-side