Move SCUM lifecycle ownership to plugin

platform/service/distribution_builder.go

@@ -6,6 +6,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"context"
+	"encoding/base64"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -158,6 +159,17 @@ func (builder *DockerDistributionBuilder) Build(input domain.DistributionBuildIn
 	if err := os.WriteFile(filepath.Join(inputDir, "auth-key"), []byte(input.AuthKey), 0o600); err != nil {
 		return nil, err
 	}
+	seedPayload := []byte("[]")
+	if strings.TrimSpace(input.WorkspaceSeed) != "" {
+		decoded, err := base64.StdEncoding.DecodeString(input.WorkspaceSeed)
+		if err != nil {
+			return nil, validationError("distribution build input has an invalid workspace seed")
+		}
+		seedPayload = decoded
+	}
+	if err := os.WriteFile(filepath.Join(inputDir, "workspace-seed.json"), seedPayload, 0o600); err != nil {
+		return nil, err
+	}
 	if err := os.WriteFile(filepath.Join(inputDir, "build.sh"), []byte(distributionBuildScript), 0o500); err != nil {
 		return nil, err
 	}
@@ -197,7 +209,16 @@ set -eu
 
 auth_key="$(cat /workspace/input/auth-key)"
 if [ "$COMPONENT_KIND" = "run" ]; then
-  cd /workspace/source
+  rm -rf /workspace/build/run-source
+  mkdir -p /workspace/build/run-source
+  cp -R /workspace/source/. /workspace/build/run-source/
+  seed_b64="$(base64 /workspace/input/workspace-seed.json | tr -d '\n')"
+  cat > /workspace/build/run-source/config/workspace_seed_generated.go <<EOF
+package config
+
+func init() { BuildWorkspaceSeed = "$seed_b64" }
+EOF
+  cd /workspace/build/run-source
   ldflags="-s -w"
   ldflags="$ldflags -X browser.local/run/config.BuildMode=worker"
   ldflags="$ldflags -X browser.local/run/config.BuildPlatformURL=$PLATFORM_URL"