fix: separate run builders from generated workers

platform/service/job_channel.go

@@ -29,6 +29,9 @@ func (svc *CoreService) ClaimRunJob(claim domain.RunJobClaim) (domain.RunJobClai
 	if err != nil {
 		return domain.RunJobClaimResult{}, err
 	}
+	if session.RequireSignedRequests {
+		claim.Capabilities = withoutCapability(claim.Capabilities, domain.JobCapabilityDistributionBuild)
+	}
 
 	stamp := svc.now()
 	svc.jobMu.Lock()
@@ -40,6 +43,9 @@ func (svc *CoreService) ClaimRunJob(claim domain.RunJobClaim) (domain.RunJobClai
 	if claim.Capacity.MaxJobs > 0 && claim.Capacity.RunningJobs >= claim.Capacity.MaxJobs {
 		return emptyJobClaim(claim.RunEndpointID, stamp), nil
 	}
+	if session.RequireSignedRequests && len(claim.Capabilities) == 0 {
+		return emptyJobClaim(claim.RunEndpointID, stamp), nil
+	}
 	jobs, err := svc.store.Jobs().List(domain.JobFilter{RunEndpointID: claim.RunEndpointID})
 	if err != nil {
 		return domain.RunJobClaimResult{}, err
@@ -82,6 +88,16 @@ func (svc *CoreService) ClaimRunJob(claim domain.RunJobClaim) (domain.RunJobClai
 	}), nil
 }
 
+func withoutCapability(capabilities []string, forbidden string) []string {
+	filtered := make([]string, 0, len(capabilities))
+	for _, capability := range capabilities {
+		if capability != forbidden {
+			filtered = append(filtered, capability)
+		}
+	}
+	return filtered
+}
+
 func (svc *CoreService) AckRunJob(ack domain.RunJobAck) (domain.RunJobAckResult, error) {
 	if err := validator.ValidateRunJobAck(ack); err != nil {
 		return domain.RunJobAckResult{}, err