feat(worker): adopt canonical public URL

internal/distworker/runner.go

@@ -990,7 +990,24 @@ func (r *Runner) applyInit(init *wire.WorkerInit) {
 	r.systemContactsMu.Unlock()
 
 	r.urlMu.Lock()
-	r.url = init.URL
+	accepted, field := init.PublicURL, "public_url"
+	if accepted == "" {
+		accepted, field = init.URL, "url" // legacy wire field (bounded migration)
+	}
+	// Validate the control-plane-supplied endpoint before accepting it.
+	// On an unusable value keep the previous accepted URL (never regress
+	// to a blank or garbage endpoint) and surface the rejection. A valid
+	// empty value still clears the stored URL.
+	var err error
+	if accepted != "" {
+		err = ValidateAdvertisedURL(accepted)
+	}
+	if err != nil {
+		log.Printf("worker: ignoring invalid advertised URL from control plane (%s=%q): %v",
+			field, accepted, err)
+	} else {
+		r.url = accepted
+	}
 	r.urlMu.Unlock()
 
 	// Peers is the slice of other workers this node can reach for