Scope broker GetKey to the requesting project (per-project socket + name-based derivation) — fixes #7

[amiller]

Implements the operator decision on #7 (per-project broker socket + name-based derivation). See #7 for the design rationale and the runnable demo.

Change

proxy/dstack_proxy.py + proxy/main.py:

1. DstackProxy.__init__ takes a project_id. GetKey no longer trusts a caller-supplied path:
   • Read a name field from the request body (key name, no slashes).
   • Construct the path server-side: /tee-daemon/projects/<project_id>/<name>.
   • Reject any name containing /, .., or a leading . (defense-in-depth; there should be no path to traverse).
   • If a legacy path is supplied, ignore it (or 400 — see acceptance).
2. The daemon binds one filtered proxy per project at /var/run/broker/<project>/dstack.sock instead of a single shared dstack.sock.
3. proxy/deploy.py: mount only the project's own socket dir into that project's container at /run/broker/ (replace the shared BROKER_VOLUME_NAME mount with a per-project mount).

Acceptance

• A tenant for project A requesting name=master derives /tee-daemon/projects/A/master; the same request from project B derives /tee-daemon/projects/B/master — different keys, no cross-talk.
• A tenant for project A that sends path=/tee-daemon/projects/B/... (old-style) CANNOT derive B's key — the field is ignored (or 400).
• name with .. or / is rejected.
• Existing single-project deploys still work (project_id defaults sanely).
• Add a proxy unit test mirroring the demo's two assertions (own-key works; cross-project denied).
• Cross-link Attested gVisor (runsc) tenants can't reach the broker unix socket — need host-UDS or a TCP broker #6: the same per-project socket must be the one mounted for attested runsc tenants — do not introduce a shared broker endpoint.

Reference

Runnable local demo of this exact mechanism (vulnerable→fixed): see the operator briefing linked from #7. The fixed-mode proxy in the demo is the reference implementation for the name-based construction.

[amiller]

Autonomous pass opened PR #81 (branch staging-80) with the proxy-level fix + per-project sockets + per-project mounts. test_daemon.py suite is GREEN on zed, including two new unit tests (GetKey derivation scoping + DstackProxyManager per-project sockets).

Not labeled ready-to-merge — this is a daemon-behavior change and per reports/RUBRIC.md it should be deployed to webhost-staging and pinned before merge. That step is operator-run from this box (no ghcr push creds / docker-compose.webhost-staging.yaml here — box-inventory).

Operator steps to finish verification + merge:

1. Staging compose change (required, or the broker silently disables): in docker-compose.webhost-staging.yaml, replace the broker_sock named-volume mount at /var/run/broker with a host bind (e.g. ${BROKER_HOST_PATH:-/var/run/tee-broker}:/var/run/broker) and set env BROKER_HOST_PATH to that host path. BROKER_VOLUME_NAME is no longer read.
2. ship-fix.sh staging + paste GET /_api/version → {"commit": "<sha>"} showing the running daemon is PR Scope broker GetKey to requesting project — fixes #7 (#80) #81's commit.
3. Smoke an attested app's broker reachability on staging (/run/broker/dstack.sock), then label the PR ready-to-merge.

Cross-link #6: the per-project socket mounted into attested containers is the one this fix produces — no shared broker endpoint is introduced.