feat(runtime-exposure): echo persisted exposure state through API serializers (PAP-17051)

Surface the structured HTTPS exposure state to API/UI consumers,
modelled independently of process healthStatus so the UI can show
provisioning/failed/cleanup_pending separately from backend health.

- Add optional exposure: RuntimeExposureStatus | null to
  WorkspaceRuntimeService and WorkspaceOverviewPrimaryService.
- Echo row.exposure / service.exposure in the execution-workspaces
  serializers (defaults to null when the service does not opt in).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/shared/src/types/workspace-runtime.ts

@@ -1,4 +1,5 @@
 import type { TrustAuthorizationPolicy } from "../trust-policy.js";
+import type { RuntimeExposureStatus } from "./runtime-exposure.js";
 
 export type ExecutionWorkspaceStrategyType =
   | "project_primary"
@@ -211,6 +212,8 @@ export interface WorkspaceOverviewPrimaryService {
   url: string | null;
   port: number | null;
   healthStatus: WorkspaceRuntimeService["healthStatus"];
+  /** HTTPS exposure state, surfaced separately from process `healthStatus`. */
+  exposure?: RuntimeExposureStatus | null;
   updatedAt: Date;
 }
 
@@ -305,6 +308,12 @@ export interface WorkspaceRuntimeService {
   stoppedAt: Date | null;
   stopPolicy: Record<string, unknown> | null;
   healthStatus: "unknown" | "healthy" | "unhealthy";
+  /**
+   * Structured HTTPS exposure state for the opt-in `tailscale_https` mode,
+   * modelled independently of `healthStatus` (process health). Null when the
+   * service does not opt into exposure. See PAP-17049 / PAP-17050.
+   */
+  exposure?: RuntimeExposureStatus | null;
   configIndex?: number | null;
   createdAt: Date;
   updatedAt: Date;