feat(runtime): heartbeat immediately after claim

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9

.forgejo/workflows/runtime-contract.yaml

@@ -0,0 +1,44 @@
+name: Governed runtime contract
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  contract:
+    runs-on: self-hosted
+    steps:
+      # The Railiance host runner does not support actions/checkout. Clone the
+      # exact pushed revision and the source revisions declared by the lock.
+      - name: Verify pinned cross-package runtime
+        env:
+          FORGE_BASE: ${{ github.server_url }}
+          REPO_NAME: ${{ github.repository }}
+          REPO_SHA: ${{ github.sha }}
+        run: |
+          set -eu
+          work_dir="$(mktemp -d /tmp/rein-contract.XXXXXX)"
+          trap 'rm -rf "${work_dir}"' EXIT
+
+          git clone "${FORGE_BASE}/${REPO_NAME}.git" "${work_dir}/rein-aharness"
+          git -C "${work_dir}/rein-aharness" checkout --detach "${REPO_SHA}"
+
+          lock="${work_dir}/rein-aharness/deploy/runtime-contract-lock.json"
+          llm_sha="$(python3 -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "llm-connect"))' "${lock}")"
+          glas_sha="$(python3 -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "glas-harness"))' "${lock}")"
+          sandbox_sha="$(python3 -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "sandboxer"))' "${lock}")"
+
+          git clone "${FORGE_BASE}/coulomb/llm-connect.git" "${work_dir}/llm-connect"
+          git -C "${work_dir}/llm-connect" checkout --detach "${llm_sha}"
+          git clone "${FORGE_BASE}/coulomb/glas-harness.git" "${work_dir}/glas-harness"
+          git -C "${work_dir}/glas-harness" checkout --detach "${glas_sha}"
+          git clone "${FORGE_BASE}/coulomb/sand-boxer.git" "${work_dir}/sand-boxer"
+          git -C "${work_dir}/sand-boxer" checkout --detach "${sandbox_sha}"
+
+          cd "${work_dir}/rein-aharness"
+          python3 -m venv .venv
+          .venv/bin/pip install --disable-pip-version-check 'uv==0.8.0'
+          .venv/bin/uv sync --frozen --no-editable --extra glas --extra llm --extra dev
+          make contract-test