[rmcdaniel]

Part of #325. Stacked on #667; I'll retarget it to main once #667 merges.

Gap. Native accepted a registration without the capability_manifest that Server 2.10.0 requires from protocol 1.18. It also skipped most of PHP's registration rules and capability guards.

Request rules (WorkerController::register). Laravel's trimming and empty-to-null run first, then PHP's rules with Laravel's 422 messages:

• runtime must be one of PHP's values; sizes, capacities, task slots, process metrics and heartbeat interval are checked.
• The manifest is required from protocol 1.18 and must hold the local_activities, worker_sessions and sticky_execution entries, each with supported and minimum_protocol_version.
• The rule engine gains numeric and required_array_keys. A nested *.field rule now covers only array items, as Laravel's expansion does.

Guards, in PHP's order. Each answers 409 with registered: false:

• prepared local activities (three checks);
• Nexus and cooperative cancellation below protocol 1.20;
• worker_capability_manifest_mismatch and worker_capability_protocol_floor_mismatch;
• workflow_metadata_capability_protocol_mismatch, now with PHP's capability / requested_version / remediation fields instead of native's former worker_capability / recorded;
• message_streams_unavailable.

Registration refusals carry protocol_version and server_capabilities, as WorkerProtocol::json does.

Accepted registrations.

• An unnamed worker gets a ULID.
• Missing type lists are stored empty.
• Capabilities keep their non-empty strings.
• The manifest is stored normalized.

Tests.

• tests/execution/worker_admission.rs uses the server's own router. It covers the manifest requirement and its errors, the field rules, the generated id, the stored manifest and every guard.
• The other execution tests' router adds the manifest an SDK sends from 1.18.
• Two cooperative tests now register at 1.20, since PHP refuses cooperative_cancellation below it. They still poll at the protocol each case tests.

Results.

• SQLite, all targets: 230 unit, 401 execution and 2 upgrade tests passed.
• Worker, registration, admission, cooperative and namespace tests: PostgreSQL 124, MySQL 124.

Checkpoint: docs/rust-server-port-checkpoints/2026-10-22-worker-admission.md. The gap list entry is removed.

[rmcdaniel]

Riding merge train #675 with #667, #669, #670 and #674 on main 17dc12cd, so they share one CI run. This PR closes with a link once the train merges.