feat(worker): adopt canonical public URL

docs/public-endpoint-and-identity.md

@@ -6,6 +6,16 @@ Accepted target architecture. Ordinary peer status checks already support an
 external HTTPS worker URL. Raft currently uses a separate plaintext listener,
 static peers, and shared Basic authentication; it does not yet meet this plan.
 
+Milestone 1 (worker side) is implemented: the worker configures `PUBLIC_URL`
+as the canonical advertised origin with the legacy `WORKER_URL` accepted only
+for a bounded migration, and validates the origin shape at startup and install
+time. On the wire the worker consumes the accepted endpoint from
+`wire.WorkerInit` (`public_url`, falling back to the legacy `url` field) and
+rejects unusable values. Transmitting the proposed URL during registration is
+the pending RSMon control-plane counterpart: it must populate `public_url` in
+`WorkerInit` and accept `RegisterRequest.public_url`; until then the worker
+reads whichever field the control plane sends.
+
 ## One Worker, One Public URL
 
 Every worker configures one absolute `PUBLIC_URL`, for example:
@@ -103,6 +113,16 @@ voter.
 
 1. Add `PUBLIC_URL` wire/config fields while accepting legacy `WORKER_URL` only
    for a bounded migration.
+
+   Worker side implemented: `PUBLIC_URL` is canonical, `WORKER_URL` is a
+   deprecated fallback with a startup warning, `internal/wire` carries
+   `public_url` on `WorkerInit` (keeping `url` for compatibility), and
+   startup/install enforce the strict origin shape for `PUBLIC_URL` while
+   tolerating legacy `WORKER_URL` shapes. Control-plane counterpart: read
+   `RegisterRequest.public_url` when worker-initiated registration is wired,
+   populate `public_url` (not `url`) in `WorkerInit`, and persist the accepted
+   origin. Until then the worker consumes whichever of `public_url`/`url` the
+   control plane sends.
 2. Validate ownership/reachability and return accepted signed configuration.
 3. Add scoped, versioned in-memory peer topology and concurrent health probes.
 4. Extend status APIs/UI with networking, control-plane RTT, and Raft state.