fix: revert security + workflow regressions to current main

Addresses three REQUEST_CHANGES reviews on PR#717:

1. [OFFSEC-001 CRITICAL] mcp.go + mcp_test.go: restore safe error message
   - PR reverted the OFFSEC-001 fix: re-adds req.Method echo in error
   - Also removed the test assertions verifying constant error message
   - Restored: Message="method not found" (no user-controlled data leak)
   - Restored: test guards verifying constant-message contract

2. [core-devops] redeploy-tenants-{main,staging}.yml + staging-verify.yml:
   - PR restored workflow_run triggers (unsupported on Gitea 1.22.6)
   - Reverted to current main (push+paths trigger pattern)

3. [infra-sre] audit-force-merge.yml: restore REQUIRED_CHECKS
   - Reverted to CI/all-required + sop-checklist/all-items-acked

.gitea/workflows/redeploy-tenants-on-main.yml

@@ -9,12 +9,11 @@ name: redeploy-tenants-on-main
 #   - Workflow-level env.GITHUB_SERVER_URL pinned per
 #     feedback_act_runner_github_server_url.
 #   - `continue-on-error: true` on each job (RFC §1 contract).
-#   - **Gitea workflow_run trigger limitation**: Gitea 1.22.6's support
-#     for the `workflow_run` event is partial. If this never fires on a
-#     real publish-workspace-server-image completion, the follow-up
-#     triage PR should replace the trigger with a push-with-paths-filter
-#     on .gitea/workflows/publish-workspace-server-image.yml. Until
-#     then continue-on-error+dead-workflow doesn't break anything.
+#   - ~~**Gitea workflow_run trigger limitation**~~ FIXED: replaced with
+#     push+paths filter per this PR. Gitea 1.22.6 does not support
+#     `workflow_run` (task #81). The push trigger fires on every
+#     commit to publish-workspace-server-image.yml which is the
+#     same signal (only successful runs commit to main).
 #
 
 # Auto-refresh prod tenant EC2s after every main merge.
@@ -50,10 +49,11 @@ name: redeploy-tenants-on-main
 # target_tag=<sha>, re-pulling the older image on every tenant.
 
 on:
-  workflow_run:
-    workflows: ['publish-workspace-server-image']
-    types: [completed]
+  push:
     branches: [main]
+    paths:
+      - '.gitea/workflows/publish-workspace-server-image.yml'
+  workflow_dispatch:
 permissions:
   contents: read
   # No write scopes needed — the workflow hits an external CP endpoint,

.gitea/workflows/redeploy-tenants-on-staging.yml

@@ -9,12 +9,13 @@ name: redeploy-tenants-on-staging
 #   - Workflow-level env.GITHUB_SERVER_URL pinned per
 #     feedback_act_runner_github_server_url.
 #   - `continue-on-error: true` on each job (RFC §1 contract).
-#   - **Gitea workflow_run trigger limitation**: Gitea 1.22.6's support
-#     for the `workflow_run` event is partial. If this never fires on a
-#     real publish-workspace-server-image completion, the follow-up
-#     triage PR should replace the trigger with a push-with-paths-filter
-#     on .gitea/workflows/publish-workspace-server-image.yml. Until
-#     then continue-on-error+dead-workflow doesn't break anything.
+#   - ~~**Gitea workflow_run trigger limitation**~~ FIXED: replaced with
+#     push+paths filter per this PR. Gitea 1.22.6 does not support
+#     `workflow_run` (task #81). The push trigger fires on every
+#     commit to publish-workspace-server-image.yml which is the
+#     same signal (only successful runs commit to main). Removed
+#     `workflow_run.conclusion==success` job if since push implies
+#     the workflow completed and committed.
 #
 
 # Auto-refresh staging tenant EC2s after every staging-branch merge.
@@ -50,10 +51,11 @@ name: redeploy-tenants-on-staging
 # of a known-good build.
 
 on:
-  workflow_run:
-    workflows: ['publish-workspace-server-image']
-    types: [completed]
-    branches: [main]
+  push:
+    branches: [staging]
+    paths:
+      - '.gitea/workflows/publish-workspace-server-image.yml'
+  workflow_dispatch:
 permissions:
   contents: read
   # No write scopes needed — the workflow hits an external CP endpoint,
@@ -73,12 +75,6 @@ env:
 jobs:
   # bp-exempt: post-merge staging redeploy side effect; CI / all-required gates source changes.
   redeploy:
-    # Skip the auto-trigger if publish-workspace-server-image didn't
-    # actually succeed. workflow_run fires on any completion state; we
-    # don't want to redeploy against a half-built image.
-    # NOTE (Gitea port): workflow_dispatch trigger dropped; only the
-    # workflow_run path remains.
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
     # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.

.gitea/workflows/staging-verify.yml

@@ -11,11 +11,14 @@ name: Staging verify
 #   - Workflow-level env.GITHUB_SERVER_URL pinned per
 #     feedback_act_runner_github_server_url.
 #   - `continue-on-error: true` on each job (RFC §1 contract).
-#   - **Gitea workflow_run trigger limitation**: Gitea 1.22.6's support
-#     for the `workflow_run` event is partial. If this never fires on a
-#     real publish-workspace-server-image completion, the follow-up
-#     triage PR should replace the trigger with a push-with-paths-filter
-#     on the same publish workflow's path (i.e. `.gitea/workflows/publish-workspace-server-image.yml`).
+#   - ~~**Gitea workflow_run trigger limitation**~~ FIXED: replaced with
+#     push+paths filter per this PR. Gitea 1.22.6 does not support
+#     `workflow_run` (task #81). The push trigger fires on every
+#     commit to publish-workspace-server-image.yml. Removed the
+#     `workflow_run.conclusion==success` job if since the push trigger
+#     doesn't carry completion state — the smoke test is the safety net
+#     (it will detect and abort on a bad image regardless). Added
+#     workflow_dispatch for manual runs.
 #
 
 # Runs the canary smoke suite against the staging canary tenant fleet
@@ -59,9 +62,11 @@ name: Staging verify
 #     are populated.
 
 on:
-  workflow_run:
-    workflows: ["publish-workspace-server-image"]
-    types: [completed]
+  push:
+    branches: [staging]
+    paths:
+      - '.gitea/workflows/publish-workspace-server-image.yml'
+  workflow_dispatch:
 permissions:
   contents: read
   packages: write
@@ -79,10 +84,6 @@ env:
 jobs:
   # bp-exempt: post-merge staging verification side effect; CI / all-required gates merges.
   staging-smoke:
-    # Skip when the upstream workflow failed — no image to test against.
-    # workflow_dispatch trigger dropped in this Gitea port; only the
-    # workflow_run path remains.
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
     # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.

workspace-server/internal/handlers/mcp.go

@@ -434,7 +434,8 @@ func (h *MCPHandler) dispatchRPC(ctx context.Context, workspaceID string, req mc
 		}
 
 	default:
-		base.Error = &mcpRPCError{Code: -32601, Message: "method not found: " + req.Method}
+		// Per OFFSEC-001: error message must not include user-controlled req.Method.
+		base.Error = &mcpRPCError{Code: -32601, Message: "method not found"}
 	}
 
 	return base

workspace-server/internal/handlers/mcp_test.go

@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"strings"
 	"testing"
 
 	"errors"
@@ -204,6 +205,9 @@ func TestMCPHandler_NotificationsInitialized_Returns200(t *testing.T) {
 // Unknown method
 // ─────────────────────────────────────────────────────────────────────────────
 
+// TestMCPHandler_UnknownMethod_Returns32601 verifies dispatchRPC returns
+// -32601 for an unknown method. Per OFFSEC-001: the error message must be
+// constant — req.Method is user-controlled and must NOT appear in the response.
 func TestMCPHandler_UnknownMethod_Returns32601(t *testing.T) {
 	h, _ := newMCPHandler(t)
 
@@ -224,6 +228,14 @@ func TestMCPHandler_UnknownMethod_Returns32601(t *testing.T) {
 	if resp.Error.Code != -32601 {
 		t.Errorf("expected code -32601, got %d", resp.Error.Code)
 	}
+	// Message must be constant — no user-controlled method name leak.
+	if resp.Error.Message != "method not found" {
+		t.Errorf("error message should be constant 'method not found', got: %q", resp.Error.Message)
+	}
+	// Double-check the method name never appears in the message (defence-in-depth).
+	if strings.Contains(resp.Error.Message, "not/a/real/method") {
+		t.Error("error message must not echo the user-controlled method name")
+	}
 }
 
 // ─────────────────────────────────────────────────────────────────────────────