browser/openspec/changes/fix-run-build-worker-role/tasks.md

1. Binding migration and registration fence

• 1.1 Promote a failed or draft legacy endpoint to a deployment target when Run generation is explicitly requested, reserving the deterministic server Run endpoint first.
• 1.2 Reject component-authenticated registration that does not match the server's dedicated endpoint identity and prevent signed component sessions from claiming distribution builds.
• 1.3 Add Platform regression coverage for legacy promotion, build targeting, stale package registration rejection, and signed-component claim rejection.

2. Role-aware Run worker capabilities

• 2.1 Derive worker capabilities from the component role and omit build-only capabilities from generated Run packages.
• 2.2 Add Run tests for generic builder and generated server Run capability reports.

3. Verification

• 3.1 Run focused and full Platform/Run test suites, a Windows amd64 build-worker test, an approved-snapshot PE build proof, and isolated local debug smoke with generated artifact download evidence.
• 3.2 Run openspec validate fix-run-build-worker-role --strict and scripts/check-structure.sh.