Implement public debug attach authorization

scripts/cli-first-contract-smoke.js

@@ -108,6 +108,7 @@ for (const [name, pattern] of [
   ["CLI key lifecycle coverage", /fn key_lifecycle_reports_project_scoped_agent_credentials\(\)/],
   ["CLI node revoke coverage", /fn node_revoke_reports_scoped_credential_revocation\(\)/],
   ["CLI admin public API coverage", /fn admin_status_and_suspend_use_public_coordinator_api\(\)/],
+  ["CLI debug attach coverage", /fn debug_attach_reports_public_authorization\(\)/],
   ["doctor unchecked reachability coverage", /fn doctor_reports_unchecked_coordinator_reachability_without_config\(\)/],
   ["doctor ping reachability coverage", /fn doctor_pings_configured_coordinator\(\)/],
   ["project local config coverage", /fn project_init_select_and_status_use_local_project_config\(\)/],
@@ -149,6 +150,11 @@ expect(
   "coordinator public admin suspension coverage",
   /fn service_reports_and_enforces_public_admin_tenant_suspension\(\)/
 );
+expect(
+  coordinator,
+  "coordinator debug attach coverage",
+  /fn service_authorizes_debug_attach_through_public_api\(\)/
+);
 
 for (const [name, pattern] of [
   ["agent --json flag", /struct AgentEnrollArgs[\s\S]*#\[arg\(long\)\]\s*json: bool/],

scripts/user-session-token-boundary-smoke.js

@@ -63,6 +63,7 @@ for (const variant of [
   "CancelTask",
   "CancelProcess",
   "PollTaskControl",
+  "DebugAttach",
   "TaskCompleted",
 ]) {
   assertNoUserSessionCredential(