[Compute Separation] BYOC M1 one-worker HTTP vertical slice

#### What problem would the feature you're requesting solve? Please describe.

The current compute-separation roadmap is not represented by current GitHub issues in this repository. The previous issue set (#11640-#11686) describes the superseded inbound-server/runtime-flag prototype and is intentionally closed. BYOC M1 now needs a reviewable, dependency-ordered Host and WorkerProxy delivery chain that can be closed by pull requests.

#### Describe the solution you'd like

Track the minimum one-worker HTTP vertical slice required by [BYOC beta checkpoint #219](https://github.com/serverless-paas-balam/FlexConsumption-BYOC/issues/219).

The M1 success flow is:

1. Platform creates and specializes one worker pod and assigns its WorkerProxy.
2. The dedicated compute Host links outbound through WorkerProxy to the worker.
3. The Host indexes worker-provided function metadata and starts ScriptHost after the first completed link.
4. WorkerProxy freezes the worker HTTP endpoint, reports readiness, and forwards HTTP.
5. The Host publishes a monotonic positive capacity revision only after the worker is eligible.
6. Frontend/appserver routes one anonymous HTTP request to the Host.
7. The request reaches the .NET isolated worker through WorkerProxy, both the HTTP and FunctionRpc/EventStream legs terminate, and the client receives `200` with the expected body.

**Required roadmap records**

- Completed foundations: `HT1`, `HT2`, `HP1`, `HP2`.
- In flight: `HT3` (PR #11964).
- Remaining Host work: `HT4`, `HT5`, `HT6`, `HT7`, `HT8a`, `HT8b`, `PR-M10+HB4A`, `HT9`, `HT10-M1+HT13B-M1`.
- Remaining WorkerProxy work: `HP3+HP5A-M1`, `HP4`.
- Cross-cutting decisions/guards: `HT13`, `HT14`.

There are 16 product PRs in the complete chain: four are already merged; 12 still need completion, consisting of PR #11964 plus 11 future PRs. `HT13` and `HT14` are required tracking issues without dedicated PRs.

**M1 configuration boundary**

Customer `host.json` delivery is deferred. This milestone uses platform-provided environment configuration, a default `{"version":"2.0"}` Host configuration restricted to the allowlisted M1 path, an anonymous sample function, and explicit secret-storage behavior. The test/default provider must not become a general production fallback.

**Product boundaries**

- Standard WebHost remains unchanged and contains Rpc.Server, never Rpc.Client, the compute product, or WorkerProxy.
- Compute topology is selected statically by a dedicated executable/image, never by a runtime feature flag in shared startup.
- Go appserver owns Frontend request-slot allocation. The Host owns worker eligibility and revisioned capacity/health publication.
- The prototype branch is a behavioral reference only; each PR is reconstructed from the verified `dev` foundation.

**Required external dependencies**

[internal BYOC #219](https://github.com/serverless-paas-balam/FlexConsumption-BYOC/issues/219) continues to own Legion orchestration, HostRole/cell/network preparation, appserver and nginx behavior, Frontend routing, production image assembly/cache/pull, registry publication, stamp rollout, and checkpoint evidence. This repository supplies the Host/WorkerProxy artifacts, contracts, signals, link/invocation behavior, and the required .NET isolated test-app source/container definition (#12008) that those systems consume.

**Parallel non-blocking validation**

Aspire issues `AH1+AH1B+AH2+AH3`, `AH4-M1`, `AH4B`, and `AH5+AH6A-M1` should run in parallel when time permits. They are valuable local/project/container validation but are not in the BYOC-M1 milestone and do not block this feature or the stamp checkpoint.

**Explicitly deferred from BYOC-M1**

- customer `host.json` delivery and configuration profiles;
- production authentication/security and certificate rotation;
- reconnect, relink, eviction, and drain hardening;
- multi-worker/function-group listener behavior;
- billing and broad diagnostics;
- extension gRPC, Durable tunnel, and .NET assembly streaming;
- broad compatibility/GA parity.

**Completion criteria**

- All required BYOC-M1 child issues are closed or have accepted evidence.
- The image owner can consume immutable compute Host and WorkerProxy artifacts.
- Required test-app issue #12008 is complete, and the checkpoint records the immutable digest of its deployed worker-only .NET isolated image.
- [internal BYOC #219](https://github.com/serverless-paas-balam/FlexConsumption-BYOC/issues/219) records the deployed Host artifact SHA/digest, link/readiness/capacity evidence, request correlation, dual-leg terminal evidence, and expected `200` response.
- The beta plaintext exception is recorded as non-production evidence and no production security gate is marked passed.
- Standard Host service graph, publish output, startup, process behavior, and tests remain unchanged.

#### Describe alternatives you've considered

- Reopening the old prototype issues was rejected because their architecture and issue boundaries are obsolete.
- Reusing the existing **Decouple Workers from Host release** milestone was rejected because it tracks worker site-extension decoupling, not compute separation.
- One issue per roadmap lane was rejected because those PRs would be too large to review. Adjacent IDs are bundled only when they produce one small observable behavior.

#### Additional context

- [Cross-team GA roadmap](https://github.com/serverless-paas-balam/Functions-NoPlaceholders/blob/brettsam/ga_plan/docs/host/ga/roadmap.md)
- [Incremental PR roadmap](https://github.com/serverless-paas-balam/Functions-NoPlaceholders/blob/brettsam/ga_plan/docs/host/ga/compute-separation-pr-roadmap.md)
- [GA architecture plan](https://github.com/serverless-paas-balam/Functions-NoPlaceholders/blob/brettsam/ga_plan/docs/host/ga/ga-plan.md)
- [BYOC beta checkpoint #219](https://github.com/serverless-paas-balam/FlexConsumption-BYOC/issues/219)

## Required BYOC-M1 tasks

Completed foundations:

- [x] `HT1` #11968 — delivered by PR #11916
- [x] `HT2` #11966 — delivered by PR #11940
- [x] `HP1` #11969 — delivered by PR #11921
- [x] `HP2` #11967 — delivered by PR #11949

Open product and tracking work:

- [x] `HT3` #11970 — PR #11964 is open
- [x] `HT4` #11979 — Client channel registry and link primitive
- [x] `HT5` #11981 — Client invocation dispatcher
- [x] `HT6` #11980 — Client metadata provider
- [x] `HT7` #11984 — PR #11988 is open
- [x] `HT8a` #11983 — populate the existing Client worker composition graph
- [ ] `HT8b` #11982 — first-link deferred ScriptHost startup
- [ ] `PR-M10+HB4A` #11986 — publish the existing compute Host as an isolated artifact
- [ ] `HT9` #11985 — compute-only worker link and acceptance endpoint
- [ ] `HT10-M1+HT13B-M1` #11987 — first-worker readiness and revisioned capacity
- [ ] `HT13` #11971 — Host/appserver/nginx M1 contract decision
- [ ] `HT14` #11972 — continuous standard-product protection evidence
- [ ] `HP3+HP5A-M1` #11974 — WorkerProxy assignment/readiness and M1 APIs
- [ ] `HP4` #11973 — WorkerProxy HTTP forwarding

Required test artifact (independent of the optional Aspire harness):

- [ ] #12008 — BYOC .NET isolated test-app container. This is required to complete M1 and is an additional test-artifact deliverable, not a product PR in the chain above.

## Required dependency graph

```text
HT1 #11968 -> HT2 #11966 -> HT3 #11970 -> HT4 #11979
HT4 #11979 -> HT5 #11981 + HT6 #11980
HT1 #11968 -> HT7 #11984
HT5 #11981 + HT6 #11980 + HT7 #11984 -> HT8a #11983 -> HT8b #11982
HT8b #11982 -> PR-M10+HB4A #11986
HT4 #11979 + HT8b #11982 + HT13 #11971 -> HT9 #11985
HP1 #11969 -> HP2 #11967 -> HP3+HP5A-M1 #11974
+-> HP4 #11973
HT9 #11985 + HP3+HP5A-M1 #11974 + HT13 #11971 -> HT10-M1+HT13B-M1 #11987
```

All implementation PRs must post the evidence required by HT14 #11972.

## Parallel non-blocking Aspire validation

These related issues are intentionally outside `BYOC-M1`, are not required sub-issues, and do not block this Feature or [internal BYOC #219](https://github.com/serverless-paas-balam/FlexConsumption-BYOC/issues/219):

- `AH1+AH1B+AH2+AH3` #11976 — project-mode transport harness
- `AH4-M1` #11975 — early real .NET isolated worker HTTP oracle
- `AH4B` #11977 — project mode through real compute Host
- `AH5+AH6A-M1` #11978 — container-boundary and management/capacity oracle

AH4-M1 and AH5+AH6A-M1 reuse the required test app from #12008 rather than introducing a second fixture. Their evidence should be linked here when available, but milestone closure never waits for the Aspire harness.