Harden provider MSP tenant isolation

- isolate provider MSP tenant runtimes onto per-client Docker networks
- add adversarial proofs for workspace cap races, handoff retargeting, and org-bound agent report retargeting
- pin provider deploy proof to start Traefik before tenant network creation

deploy/provider-msp/docker-compose.yml

@@ -18,6 +18,8 @@ services:
     networks:
       - pulse-provider-msp
     restart: unless-stopped
+    labels:
+      - pulse.provider-msp.role=traefik
 
   control-plane:
     image: ${CONTROL_PLANE_IMAGE:?CONTROL_PLANE_IMAGE must be set to a digest-pinned image}
@@ -64,6 +66,7 @@ services:
       - traefik
     restart: unless-stopped
     labels:
+      - pulse.provider-msp.role=control-plane
       - traefik.enable=true
       - traefik.docker.network=${PULSE_PROVIDER_MSP_DOCKER_NETWORK:-pulse-provider-msp}
       - traefik.http.routers.provider-control-plane.rule=Host(`${DOMAIN}`)

deploy/provider-msp/run-install-proof.sh

@@ -9,9 +9,10 @@ Usage:
 Runs the provider-hosted MSP compose install proof on a Docker host:
   1. validates .env and docker-compose.yml
   2. optionally pulls the pinned Traefik and control-plane images
-  3. runs provider-msp install-proof through the compose control-plane service
-  4. starts the provider stack
-  5. runs provider-msp status as a final operator check
+  3. starts Traefik so proof workspaces can attach isolated tenant networks
+  4. runs provider-msp install-proof through the compose control-plane service
+  5. starts the provider stack
+  6. runs provider-msp status as a final operator check
 
 Options:
   --account-name NAME          Provider MSP account display name
@@ -121,6 +122,8 @@ if [[ "$skip_compose_pull" != "1" ]]; then
   docker compose pull traefik control-plane
 fi
 
+docker compose up -d traefik
+
 install_args=(
   provider-msp install-proof
   --account-name "$account_name"