fix(test): the worker-scope script sends the policy a supervisor sends

main fails scripts/test.sh at Step 5f on every platform:

    === Step 5f: worker request-scope regression ===
    worker did not index the admitted repository
    {"content":[{"type":"text","text":"missing or incomplete trusted
    worker policy"}], ... "isError":true}

Second collision from the #1723 merge (92abefa), and the same kind as
the first. #1723 made an index worker refuse any request that does not
carry `_cbm_index_policy`: a worker never resolves the resource policy
from config or environment, the supervisor does and sends it along.
tests/test_worker_session_scope.sh, added on 2026-09-06 by a08b9ec,
plays the supervisor by hand -- it runs `cli --index-worker
index_repository '{"repo_path":...,"mode":"fast"}'` directly -- and
#1723's branch never contained that script, so its CI never ran the two
together. The merge was textually clean and the result was wrong. It
stayed hidden behind the lint failure the previous commit fixes, because
the test stage only runs once lint is green.

The worker is right and the script was incomplete: it now sends what the
supervisor sends, both limits off, which is the default
(`"index_max_files":"off","index_max_source_mb":"off"`, the same object
tests/test_index_policy.c uses). The fail-closed case carries it too, so
that a request without repo_path is still refused for its missing scope
("request workspace scope invalid") and not, by accident, for a missing
policy. No assertion changed.

RED, production binary built from this branch, script unmodified:
    worker did not index the admitted repository
    ... "missing or incomplete trusted worker policy" ...      rc=1
GREEN:
    ok: index worker is scoped to the admitted request, not the daemon
    environment                                                  rc=0

On the failed CI run of this PR, 12 of the 13 red test jobs carry exactly
that signature and nothing else. The 13th, test-windows-guards, is
test_daemon_stability.py section_cold_storm ("secure CLI coordination
could not be created (endpoint)", a racing cold start) -- a known
nondeterministic guard, unrelated to either commit here. Step 6, which
Step 5f's failure kept CI from reaching, passes locally:
security-strings allow-list 4 passed, destructive-ordering contract PASS.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

Author: DeusData

tests/test_worker_session_scope.sh

@@ -70,8 +70,15 @@ run_worker() {
     --response-out "${response}" >"${out}" 2>"${err}"
 }
 
+# A worker never reads the resource policy from config or environment: the
+# supervisor resolves it and sends it inside the request, and a request
+# without one is refused ("missing or incomplete trusted worker policy").
+# This script plays the supervisor, so it sends what the supervisor sends --
+# both limits off, the default.
+policy='"_cbm_index_policy":{"index_max_files":"off","index_max_source_mb":"off"}'
+
 response="${tmpdir}/scoped.response"
-if ! run_worker "{\"repo_path\":\"${repo}\",\"mode\":\"fast\"}" "${response}" \
+if ! run_worker "{\"repo_path\":\"${repo}\",\"mode\":\"fast\",${policy}}" "${response}" \
   "${tmpdir}/scoped.out" "${tmpdir}/scoped.err"; then
   echo "worker exited nonzero for an admitted request" >&2
   cat "${tmpdir}/scoped.err" >&2
@@ -94,7 +101,7 @@ fi
 
 # Fail closed: no repo_path means no request scope, so no indexing at all.
 unscoped="${tmpdir}/unscoped.response"
-if run_worker '{"mode":"fast"}' "${unscoped}" "${tmpdir}/unscoped.out" "${tmpdir}/unscoped.err"; then
+if run_worker "{\"mode\":\"fast\",${policy}}" "${unscoped}" "${tmpdir}/unscoped.out" "${tmpdir}/unscoped.err"; then
   echo "worker ran without a request workspace scope" >&2
   exit 1
 fi