feat(ai-workspace): add local relay profiles

infra/scripts/init-dev-env.sh

@@ -16,6 +16,7 @@ rand() {
 
 cat > "$ENV_FILE" <<EOF
 # domains
+NODEDC_ENV=local
 AUTH_DOMAIN=auth.local.nodedc
 LAUNCHER_DOMAIN=launcher.local.nodedc
 TASK_DOMAIN=task.local.nodedc
@@ -61,8 +62,9 @@ COOKIE_DOMAIN=.local.nodedc
 COOKIE_SECURE=false
 
 # AI Workspace shared registry and Hub.
-# Generated local env uses the deployed relay by default. This is suitable for
-# UI/contract smoke, not proof of local live-worker write-path e2e.
+# Generated local env may use the deployed AI Hub only as a relay for remote
+# Codex workers. Launcher/Engine/Ops/Auth downstream URLs must remain local.
+# For Tailscale/ngrok-style relay URLs, set NODEDC_ENV=tunnel-local-e2e deliberately.
 AI_WORKSPACE_PG_DB=nodedc_ai_workspace
 AI_WORKSPACE_PG_USER=nodedc_ai_workspace
 AI_WORKSPACE_PG_PASS=$(rand 36)
@@ -70,6 +72,8 @@ AI_WORKSPACE_ASSISTANT_TOKEN=$(openssl rand -hex 48 | tr -d '\n')
 AI_WORKSPACE_OPS_ENTITLEMENT_URL=http://host.docker.internal:4100/api/internal/v1/ai-workspace/entitlements
 AI_WORKSPACE_OPS_ENTITLEMENT_TOKEN=replace-with-ops-agent-gateway-internal-token
 AI_WORKSPACE_OPS_ENTITLEMENT_REQUIRED=false
+AI_WORKSPACE_ASSISTANT_ACTION_RELAY_ENABLED=true
+AI_WORKSPACE_ASSISTANT_ACTION_RELAY_ID=local-dev
 AI_WORKSPACE_HUB_TOKEN=$(openssl rand -hex 48 | tr -d '\n')
 AI_WORKSPACE_HUB_HOST_BIND=127.0.0.1:18081
 AI_WORKSPACE_HUB_PUBLIC_URL=wss://ai-hub.nodedc.ru/api/ai-workspace/hub