feat(ai-workspace): add local relay profiles

docs/AI_WORKSPACE_CONFIG_CONTRACT.md

@@ -13,15 +13,19 @@ Do not mix these classes. A URL reachable from the Mac browser is not automatica
 
 ## Current Profiles
 
-`local/hybrid-prod-bridge`:
+`local/remote-worker-relay`:
 
 - Tasker UI: `http://task.local.nodedc`
 - Platform Assistant: `http://127.0.0.1:18082`
 - Local Hub process: `http://127.0.0.1:18081`
-- Default worker-facing Hub: `wss://ai-hub.nodedc.ru/api/ai-workspace/hub`
+- Default worker-facing Hub relay: `wss://ai-hub.nodedc.ru/api/ai-workspace/hub`
+- Default Assistant-to-relay control URL: `https://ai-hub.nodedc.ru`
+- Assistant action relay id: `local-dev`
+- Assistant action gateway returned to worker: `https://ai-hub.nodedc.ru/api/ai-workspace/hub/v1/assistant-relays/local-dev/actions`
 - Ops entitlement adapter: `http://host.docker.internal:4100/api/internal/v1/ai-workspace/entitlements` when deliberately enabled
 - Ops Gateway downstream Tasker: `http://task.local.nodedc`
-- This profile is valid for contract smoke and local Ops vertical smoke, not proof of live local Codex worker e2e.
+- The deployed AI Hub is allowed only as transport. Launcher, Engine, Ops, Authentik, task manager, and downstream app calls must stay local.
+- The remote worker must not call product apps directly. Assistant actions must route back through the local AI Workspace Assistant.
 
 `synology/prod-public`:
 
@@ -52,3 +56,24 @@ New apps must join AI Workspace through app manifests/config/adapters:
 - owner repo/service.
 
 Do not add app-specific address logic to the agent installer, Engine, Ops, or Platform Assistant runtime flow.
+
+## Verification
+
+Before changing worker, Assistant, Hub, or app adapter routing, run:
+
+```sh
+sh infra/scripts/check-local-test-system.sh
+```
+
+For a live local remote-worker test, require the relay topology explicitly:
+
+```sh
+REQUIRE_REMOTE_WORKER_RELAY=1 sh infra/scripts/check-local-test-system.sh
+```
+
+Security audit and test matrix:
+
+```text
+docs/AI_WORKSPACE_SECURITY_AUDIT_2026-06-20.md
+docs/AI_WORKSPACE_TEST_MATRIX.md
+```