[codex] secure extension hot reload control

[Esity]

Summary

Hardens lex-node cluster-control messages and aligns extension update behavior with extension-scoped hot reload instead of whole-daemon reload.

What changed

• Added Legion::Extensions::Node::ControlAuth for HMAC-signed control payloads with timestamp and nonce fields.
• Signed ClusterSettings and ClusterKillswitch messages and verified them in ClusterControl before runner dispatch.
• Made per-node cluster-control queues durable and non-auto-delete so node-scoped desired-state commands survive restart windows.
• Disabled immediate beat execution at actor construction to avoid startup reconciliation before extension boot completes.
• Changed update_gem to install through Legion::Extensions::GemSource and call Legion::Extensions.reload_extension instead of Legion.reload.
• Bumped lex-node to 0.3.8 and updated CHANGELOG.md.

Why

The adversarial review found the rollout/control path assumed an authorization boundary that did not exist, offline nodes could miss commands permanently, beat could race startup, and update_gem still performed full daemon reloads through raw Gem.install.

Validation

• bundle exec rubocop -A
• bundle exec rspec --format json --out tmp/rspec_results.json --format progress --out tmp/rspec_progress.txt

[Copilot]

Pull request overview

This PR hardens node cluster-control by introducing HMAC-signed control payloads and shifts extension updates to extension-scoped reloads, while improving reliability of per-node control delivery across restarts.

Changes:

• Added Legion::Extensions::Node::ControlAuth and applied signing to cluster-control messages.
• Made per-node cluster-control queues durable/non-auto-delete and prevented immediate beat execution at actor construction.
• Updated update_gem to install via Legion::Extensions::GemSource and reload a single extension instead of reloading the whole daemon; bumped version/changelog.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
lib/legion/extensions/node/control_auth.rb	Introduces signing/verification for cluster-control payloads.
lib/legion/extensions/node/actors/cluster_control.rb	Adds verification hook for incoming cluster-control messages.
lib/legion/extensions/node/transport/messages/cluster_settings.rb	Signs settings broadcast payloads.
lib/legion/extensions/node/transport/messages/cluster_killswitch.rb	Signs killswitch payloads.
lib/legion/extensions/node/transport/queues/cluster_control.rb	Makes per-node control queues durable and non-auto-delete.
lib/legion/extensions/node/actors/beat.rb	Disables immediate run on boot.
lib/legion/extensions/node/runners/node.rb	Routes gem install through GemSource and performs extension-scoped reload.
lib/legion/extensions/node/version.rb	Version bump to 0.3.8.
spec/legion/extensions/node/control_auth_spec.rb	Adds tests for signing/verification.
spec/legion/extensions/node/runners/node_spec.rb	Updates update_gem specs for GemSource + extension reload.
spec/legion/extensions/node/actors/beat_spec.rb	Aligns spec with new run_now? behavior.
spec/legion/extensions/node/transport/queues/cluster_control_spec.rb	Aligns spec with new queue durability semantics.
CHANGELOG.md	Documents changes for 0.3.8.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.