fix(registry-servers): tag registry installs with registry+server fields (#2292)

Registry-installed workloads currently send only req.image, which makes
the API treat them as direct image installs. Policy gates that allow only
registry-resolved servers then reject them — even when the image is the
exact one listed in the registry — because workload_service's image-name
lookup misses (the registry is keyed by server name, not image URL), and
RegistryServerName/RegistryAPIURL come back empty on the RunConfig.

Send registry: 'default' and server: server.name so the API takes the
resolveRegistryServer path. The canonical registry entry name is kept
separate from the user-editable workload name, which may diverge when
the user renames the workload at install time or installs the same
server twice into different groups.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: reyortiz3

renderer/src/features/registry-servers/lib/__tests__/orchestrate-run-registry-server.test.tsx

@@ -67,6 +67,8 @@ describe('prepareCreateWorkloadData', () => {
       target_port: 8080,
       network_isolation: false,
       volumes: [],
+      registry: 'default',
+      server: 'test-server',
     })
   })
 
@@ -97,9 +99,35 @@ describe('prepareCreateWorkloadData', () => {
       target_port: 8080,
       network_isolation: false,
       volumes: [],
+      registry: 'default',
+      server: 'test-server',
     })
   })
 
+  it('tags the request with the registry source so the API runs the registry-resolution path', () => {
+    const data: FormSchemaRegistryMcp = {
+      proxy_mode: 'streamable-http',
+      name: 'My Custom github',
+      group: 'default',
+      envVars: [],
+      secrets: [],
+      networkIsolation: false,
+      allowedHosts: [],
+      allowedPorts: [],
+      volumes: [],
+    }
+
+    const result = prepareCreateWorkloadData(SERVER, data)
+
+    // Workload name comes from the form (user-editable); registry entry name
+    // comes from the canonical server metadata. They are deliberately distinct
+    // so the API can resolve registry defaults even when the user renames the
+    // workload at install time.
+    expect(result.name).toBe('My Custom github')
+    expect(result.registry).toBe('default')
+    expect(result.server).toBe('test-server')
+  })
+
   it('handles empty cmd_arguments', () => {
     const data: FormSchemaRegistryMcp = {
       proxy_mode: 'streamable-http',

renderer/src/features/registry-servers/lib/orchestrate-run-registry-server.tsx

@@ -51,5 +51,14 @@ export function prepareCreateWorkloadData(
     network_isolation: networkIsolation,
     permission_profile,
     volumes,
+    // Tag the request as a registry install so the API records the source
+    // registry on the workload. `name` is the workload name (user-editable
+    // and may diverge from the registry entry name when the user installs
+    // the same server twice into different groups), so the canonical
+    // registry entry name from `server.name` is sent separately. Without
+    // these fields the API treats the request as a direct image install
+    // and policy gates that allow only registry servers reject it.
+    registry: 'default',
+    server: server.name,
   }
 }