fix(registry): changing an installed agent requires its installer or an instance admin (TASK-055)

[lilyshen0722]

The defect

PATCH /api/registry/pods/:podId/agents/:name gated on pod membership and nothing else (Vera 69500, measured on 23e00668: a non-owner member's PATCH on config.environment returned 200).

That handler merges the caller's config into the installation, and agentBinding projects config.environment to the installer's daemon as that seat's declared environment — mcp[].command and url included. So a plain member of a pod could make another member's machine run a declared stdio command, and mail that seat's runtime token to a host of their choosing.

The same handler also writes the owner's AgentProfile (displayName, status, instructions, persona, toolPolicy, contextPolicy, modelPreferences) and drives config.skillSync, so the gate is the whole PATCH (Vera 69508/69510, Wren 69512), not just the fields in the original report.

The change

One check, right after the installation lookup:

• Installer or instance admin — everyone else gets 403 { code: 'installer_only', fields: [...] }, naming the gated fields present in the body. Never a silent drop.
• Pod membership stays a precondition, not an authority. A non-member still gets the previous 403 Access denied; the new code only ever fires for a member who is not the installer.
• The fan-out is restricted too. It reaches this agent's installations in other pods, and those rows have their own installers — being the installer here is not authority over someone else's row there. An installer now writes only rows they installed; an instance admin keeps the instance-wide reach. The AgentProfile write is scoped to the same set.
• req.user.role is only populated on the API-token auth path (helpers.ts:55-64), so the admin check falls back to isGlobalAdminUser(userId) when the token did not carry it.

Deliberately not changed: install.ts is the other writer of a caller-supplied config, and it is a different act — it stamps installedBy: userId and already gates public pods and entitlements. hosted.ts writes server-set values only.

Tests

New backend/__tests__/unit/routes/registry.agent-config-installer-gate.test.js:

case	expectation
non-installer member → config.environment (with a foreign stdio command)	403 installer_only, fields: ['config'], row unchanged, no profile write
non-installer member → displayName + status	403 installer_only — the gate is the whole PATCH
installer → config	200, config merged, row saved
instance admin who is not the installer → config	200
non-member	403 Access denied (precondition unchanged)
installer of pod-1, plain member of pod-2	updatedPods: 1, pod-2's row untouched, profile write scoped to pod-1

Three existing fixtures gained installedBy (registry.patch-shared-settings, registry.tool-policy): they were exercising this handler as a pod creator with no installer, which is now a 403. No assertion was inverted — only the fixtures changed, and they still assert the same propagation.

Two consequences worth a human's eye

Both narrow, both follow from "membership is a precondition, not an authority", both one line to widen if you want them widened:

1. A pod creator who is not the installation's installer now gets 403. (Today the creator could PATCH, because creator counted as membership.)
2. An installer who is also an instance admin writes only their own rows, not every accessible row. A non-installer admin keeps the instance-wide reach.

If a UI flow edits an agent's display name as a plain member, it will now surface a 403 — that is the intended new behaviour, and the typed code is there for the UI to explain it.

Verified

• 373 unit suites / 3199 tests green under Node 20.18.1. Under the plain node v26 on this machine 34 suites fail at buffer-equal-constant-time (30 test failures) — the pre-existing baseline, unchanged by this branch.
• npm run tsc:check clean; npm run lint:ts 0 errors (1206 pre-existing warnings).
• Layer 2 (the daemon guard) is Wave's, in fix(cli): the daemon refuses a declared environment that would run a foreign command or ship the seat token off-instance #1744 — this PR is the server half only and does not depend on it.