Fix WSL worker callback routing

[IOHelpMe]

Summary

• add an explicit make watch-windows entrypoint for Docker Desktop development through WSL2
• derive the current WSL source address for Kubernetes worker callbacks while preserving explicit URL/IP overrides
• keep the existing make watch behavior unchanged for native Linux and macOS
• skip the secret-dependent prerelease job for pull requests originating from forks

Root cause

Under Docker Desktop with the daemon running inside WSL2, host.k3d.internal resolves to the Windows-side Docker gateway rather than the daemon's current WSL address. Kubernetes materialization workers could pull artifacts but could not deliver completion callbacks, so deployments remained locked and the unlock request eventually timed out.

Review feedback addressed

Platform-specific behavior is now explicit and additive: Windows users select make watch-windows; the normal make watch path contains no Windows/WSL auto-detection. Fork pull requests also no longer enter the prerelease job that depends on repository credentials.

Validation

• bash -n scripts/watch-windows.sh
• go test ./...
• full local Windows/WSL stack test: the Kubernetes worker callback completed successfully and the test ScrollDeployment reached Active

Deliberately separate work

The Docker build-cache optimization is not part of this feedback PR. It is isolated in #93 so routing fixes and performance work can be reviewed independently.

[IOHelpMe]

Review feedback update

Implemented the requested platform separation and CI fix in commit 3fe5022:

• Linux/macOS: make watch retains the original behavior.
• Windows + Docker Desktop through WSL2: use make watch-windows.
• WSL-specific routing is isolated in scripts/watch-windows.sh.
• New AGENTS.md documents command selection and overrides.
• Fork PRs no longer attempt write-protected prerelease publishing.

Verification completed:

• go test ./... passes
• build, unit tests, integration tests, and API validation pass in GitHub Actions
• prerelease and docker-builds correctly skip for this fork PR
• Bash, Make dry-run, JSON/YAML, and whitespace checks pass

[IOHelpMe]

Local Windows/WSL runtime verification

Retested make watch-windows through the updated druid-local Windows start path on the actual Windows + Docker Desktop + Ubuntu WSL2 setup.

Results:

• daemon management, public proxy, and worker callback ports (8081-8083) are listening
• the daemon advertises the dynamically derived WSL callback URL
• the callback listener is owned by the running Druid daemon
• k3d successfully reaches the callback health endpoint through that WSL URL
• Better Auth through Envoy, Harbor, SPA, website, and all remaining host services pass their local checks
• all 10 expected tmux sessions remain running

This confirms the explicit Windows command works in the real local stack, not only in Make dry-runs and CI.

[IOHelpMe]

Fresh Windows/WSL installation verification update:

• no additional CLI code changes were required beyond 3fe5022
• rebuilt/imported druid:local through the Windows start path after deleting and recreating the local k3d cluster
• daemon advertised the live WSL callback URL http://172.30.160.50:8083
• callback listener owned by the Druid daemon
• callback smoke from k3d-druid-gs-server-0: pass

The complete fresh stack finished with 10 tmux sessions and 0 non-ready Kubernetes pods. Companion installer fixes discovered by this clean run are documented in highcard-dev/druid-local#3 and highcard-dev/monorepo#315.

[IOHelpMe]

Implemented and re-verified the requested feedback on commit 3fe5022:

• Windows/WSL behavior is opt-in through make watch-windows; native make watch remains unchanged and contains no platform auto-detection.
• The wrapper resolves the current WSL callback address while retaining DRUID_HOST_SERVICES_IP and DRUID_WORKER_CALLBACK_URL overrides.
• Fork PRs skip the credential-dependent prerelease job.
• I removed all Docker performance work from this branch. That optimization is now independently reviewable in Speed up repeated runtime image builds #93.

Fresh validation after the split:

• bash -n scripts/watch-windows.sh - passed
• go test ./... - passed
• complete local Windows/WSL runtime test - worker callback completed and the deployment reached Active

I also refreshed the PR description so it matches the explicit Windows command that is actually implemented.

[druid-infra]

Error: This repo is not allowlisted for Atlantis.