feat(runtime-exposure): echo persisted exposure state through API serializers (PAP-17051)

Surface the structured HTTPS exposure state to API/UI consumers,
modelled independently of process healthStatus so the UI can show
provisioning/failed/cleanup_pending separately from backend health.

- Add optional exposure: RuntimeExposureStatus | null to
  WorkspaceRuntimeService and WorkspaceOverviewPrimaryService.
- Echo row.exposure / service.exposure in the execution-workspaces
  serializers (defaults to null when the service does not opt in).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/shared/src/types/workspace-runtime.ts

@@ -1,4 +1,5 @@
 import type { TrustAuthorizationPolicy } from "../trust-policy.js";
+import type { RuntimeExposureStatus } from "./runtime-exposure.js";
 
 export type ExecutionWorkspaceStrategyType =
   | "project_primary"
@@ -211,6 +212,8 @@ export interface WorkspaceOverviewPrimaryService {
   url: string | null;
   port: number | null;
   healthStatus: WorkspaceRuntimeService["healthStatus"];
+  /** HTTPS exposure state, surfaced separately from process `healthStatus`. */
+  exposure?: RuntimeExposureStatus | null;
   updatedAt: Date;
 }
 
@@ -305,6 +308,12 @@ export interface WorkspaceRuntimeService {
   stoppedAt: Date | null;
   stopPolicy: Record<string, unknown> | null;
   healthStatus: "unknown" | "healthy" | "unhealthy";
+  /**
+   * Structured HTTPS exposure state for the opt-in `tailscale_https` mode,
+   * modelled independently of `healthStatus` (process health). Null when the
+   * service does not opt into exposure. See PAP-17049 / PAP-17050.
+   */
+  exposure?: RuntimeExposureStatus | null;
   configIndex?: number | null;
   createdAt: Date;
   updatedAt: Date;

server/src/services/execution-workspaces.ts

@@ -981,6 +981,7 @@ function toRuntimeService(
     stoppedAt: row.stoppedAt ?? null,
     stopPolicy: (row.stopPolicy as Record<string, unknown> | null) ?? null,
     healthStatus: row.healthStatus as WorkspaceRuntimeService["healthStatus"],
+    exposure: (row.exposure as WorkspaceRuntimeService["exposure"]) ?? null,
     configIndex: row.configIndex ?? null,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,
@@ -1059,6 +1060,7 @@ function toWorkspaceOverviewPrimaryService(
     url: service.url,
     port: service.port,
     healthStatus: service.healthStatus,
+    exposure: service.exposure ?? null,
     updatedAt: service.updatedAt,
   };
 }