feat(asks): an ask raised during a Workspace chat turn attaches to that chat (ent#734)

[AndriiPasternak31]

Refs abilityai/trinity-enterprise#734
Refs abilityai/trinity-enterprise#610

Data half of ent#734; the chat tile is drawn by #3101, which lands with or after this. Covers AC 1 (record the raising chat), AC 4 (platform-written, never agent-named) and AC 5 (the backend test). AC 2/3 (tile answerable in place, ended marker) are #3101's.

No migration taken. The execution↔chat link already exists: both portal turn-creation sites (and portal_chat's cold retry) stamp source_channel="portal", source_channel_chat_id and source_channel_client on the execution row at creation (ent#457/#2426). No column, no Alembic revision, and no interaction with #3021's pending 0083.

What changes

• client_portal.service.chat_for_execution(agent, email, execution_id) (new): returns the turn's chat only if the row is this agent's running Workspace chat turn (triggered_by="public" + source_channel="portal"), its client is the addressee (case-insensitive), and the session belongs to that pair.
• operator_queue_service._workspace_thread_for(..., execution_id=None): tries that first, then falls back to the pair's Main, as before. Fail-soft: a lookup failure logs a warning tagged ent#734 and never raises (the bug: operator-queue create path has no rate limit or size caps — flooding/operator-fatigue surface (blocking pull default-ON) #1632 contract).
• Raised in a turn vs in the background (r2): a chat-turn ask raised in Main and a background ask both carry chat_id = Main, but the ent#610 amendment draws the first as a tile in Main and the second in no chat. The row therefore also carries context.workspace_raised_in_turn = true, written only when the raising turn's chat matched. _workspace_attachment returns (chat, raised_in_turn), and the flag is projected as WorkspaceAsk.raised_in_turn (only a literal true counts). This is the fact feat(workspace): Inbox asks UI + an ask's context (ent#610 PR A2: §3g L6 + L7) #3101 draws a tile from. Both workspace_* keys are _PLATFORM_CONTEXT_KEYS: they are stripped from agent-authored context on both paths and ignored by the replay differs and the bug(operator-queue): a pending approval can sit unseen for days — the human's card goes stale while the container↔platform sync stays silent #2915 file-sync comparison.
• ask_service.raise_ask: passes the platform turn (X-Trinity-Execution-Id, feat(pull): platform-injected execution id for the side-effect guard — Tier-6 T6.3, blocks default-ON for side-effect agents #2392) only for raised_by="agent". A gate raise keeps Main.
• Unchanged (Main):
  • schedules, including one that delivers into the Workspace, whose row carries the portal stamp (the reason triggered_by is checked);
  • loops, rooms, delegated children, gate raises;
  • no, unknown, foreign or finished executions;
  • another addressee's chat;
  • every file-ingested ask (an agent-written context.execution_id is never read);
  • the ent#429 strip of an agent-authored workspace_session_id.

Trust bound (review r1)

The header is set by the platform, but the agent's own process holds its key and can send any of its executions' ids. After r1, the most a forged id can do is move an ask into another running turn of the same agent for the same addressee. That is the #2392 trust level turn_audience already accepts. It can never reach another person's chat, another agent's chat, or a finished turn. The docstrings and §26.12 now say exactly this and no more. An archived (reset) Main is deliberately not excluded: it stays listed and resumable, and Reset is refused mid-turn.

Tests

• tests/unit/test_ent734_ask_raising_chat.py: 31 tests, written red-first.
• 18 named mutations, each turning the suite red:
  • chat lookup: drop the running, trigger, channel, client, session or email-case check; drop the fail-soft; let a gate read the turn; never pass the turn; exclude archived chats;
  • r2: never write the flag; write it whenever there is a thread; strip only the thread key at the native boundary, the file boundary, the replay compare or the file-sync compare; project a truthy value instead of only true; claim in-turn on the Main fallback.
• 128 related unit files: 3554 passed, 3 skipped. lint_sys_modules is at its baseline.
• test_ent611_native_ask.py: the fixture now stubs _workspace_attachment, the new core.

Docs

• security.md §26.12 (OPS-001-THREAD)
• operating-room.md "Which chat an addressed ask attaches to" + the feature-flows.md index row
• a pointer in workspace-agents-at-the-centre.md
• architecture/workspace.md (landing rule)

[vybe]

merge-train (#3143): on this train, merging second, right after #3054. /validate-pr and /review came back READY with no criticals. The tests run the real raise_ask → _workspace_attachment → chat_for_execution path, and breaking it on purpose fails tests.

Edited for you: the Refs lines are now fully qualified so GitHub links them. Once #3054 lands, I'll merge dev into this branch to resolve the paragraph conflict in workspace-agents-at-the-centre.md, keeping both paragraphs with this PR's first, the same order as #3101.

[vybe]

merge-train: batch validated on train/#3143 (all Tier 1 + Tier 2 green); dev merged in for the #3054 doc paragraph