[TheGreatAxios]

Cuts workflow_deploy over to Interchange's stock routes and reduces the
Workbench-specific /api/workflow-workflow-authoring mount to the git
operations alone. CL-8171.

What moved

workflow_deploy no longer posts to
/api/workflow-workflow-authoring/:assetId/deploy. It now:

1. reads the tenant's resolved inference catalog from stock
   GET /api/tenants/:tenantId/models,
2. flattens it into one priority-ordered sourceOfferingIds chain, and
3. posts an asset/source deploy naming the commit to stock
   POST /api/tenants/:tenantId/workflows/deployments.

The run bearer (sidecar token + x-workflow-run-address) authenticates
both, through apps/hub/src/workflow-run-tenant-auth.ts. The tenant id
rides on the step env, already threaded from the hub's signed deploy
frame by #764.

The flattening is the one non-trivial mapping and has a red/green test:
the deleted mirror resolved the chain server-side from
listVisibleOfferings sorted by priority, while the discovery route
groups its offerings under each model — so the client has to restore a
single global priority order across models, not preserve the grouping.

Deleted: the mirror route, WorkflowAuthorRegistry.deploy, and their
tests. Kept: the hub's workflowDeployer, which the on-demand
catalog-block deploy still drives — it did not fall unused.

Why the mount is reduced, not deleted

readSource / author / republish / deploy preview read and write
git trees. Their stock equivalent is git smart-HTTP on the asset repo,
and no run-bearer credential reaches it today:

• vendor/intx/hub-api/src/middleware/git-token-auth.ts gates
  /api/tenants/:tenantId/assets/:kind/:name.git/* on a secret with an
  itx_pat_ / itx_svc_ prefix that hashes to a git_token row. A run
  bearer is a sidecar row token and fails the prefix check outright.
• The stock mint route, createTenantGitTokenRoutes in
  vendor/intx/hub-api/src/routes/git-tokens.ts, is reachable under the
  widened run-bearer mount but returns 401 for a caller with no
  c.get("user"). createWorkflowRunDeployAuth sets only tenant and
  principal, never user, and the handler also wants a
  git-token:*/create grant the run principal does not hold.

So the mount stays for the git half, with a comment naming CL-8171. The
upstream ask is recorded on CL-8171 and CL-7575.

Known delta

The deleted mirror called recordAgentSessionAtProvision after
provisioning; the stock route does not, so an agent-driven deploy no
longer writes that eager agent_session row. Noted on CL-8171 — it is
inherent to "tools speak stock routes only" and wants its own fix.

Verification

bun run typecheck, bun run lint, bun run check:structural and
bun test over the touched packages all pass locally. No test stack was
running (docker compose -f docker-compose.test.yml ps is empty), so no
live author→deploy round trip was done.

https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG

[linear-code]

CL-8171