Allow trusted orchestrators to provision only a selected runtime session credential

Desired Behavior

Docker automation bundles need to start and inspect their own conversation on the inner agent-server. The command environment correctly strips session keys, and forwarding the outer key would grant access to every runtime. There is currently no authenticated control-plane endpoint to obtain only the selected runtime credential.

Acceptance Criteria

• A host-authenticated endpoint returns only the selected Docker runtime session key, never the outer server key, encryption key, or broker token.
• Responses prohibit caching and unknown conversations are rejected without provisioning.
• Automation dispatch injects this per-runtime credential explicitly into its private environment upload.
• Unauthenticated requests are denied; tests verify isolation and unknown-ID behavior.

Readiness

ready-for-dev. Depends on the per-conversation runtime provisioning in #3403.

Start by reading the per-conversation runtime provisioning work in #3403, then locate the control-plane endpoint and automation dispatch path described here. Verify the endpoint's authentication, response isolation, cache prevention, and unknown-conversation rejection, then run or add tests covering unauthenticated access, credential isolation, and unknown IDs.