fix(gateway): correct field order in workload_challenge to match ZOS

The previous arms used (name → backends → tls_passthrough → network),
which produced a different challenge byte sequence than the ZOS node
expected. The on-chain RMB deploy then failed with
`failed to verify signature`.

ZOS canonical order (pkg/gridtypes/zos/gw_name.go and gw_fqdn.go in
threefoldtech/zos v0.5.5): Name → TLSPassthrough → Backends, with no
`network` field. Updated both arms to match exactly, including the
`%t` boolean formatting used by Go's fmt.Fprintf.

Verified end-to-end on dev grid against gent02.dev.grid.tf — a
gateway-name-proxy now deploys to ready state and the assigned FQDN
is returned from the workload result.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 2 people

src/grid_client/deployment.rs

@@ -705,26 +705,30 @@ fn workload_challenge(out: &mut String, workload: &DeployWorkload) -> Result<(),
             }
         }
         zos::GATEWAY_NAME_PROXY_TYPE => {
+            // Matches the canonical Go ZOS implementation in
+            // pkg/gridtypes/zos/gw_name.go: Name → TLSPassthrough → Backends.
+            // `network` is NOT included in the challenge — ZOS rejects the
+            // signature otherwise.
             let data: GatewayNameProxyData =
                 serde_json::from_value(workload.data.clone()).map_err(GridError::from)?;
             out.push_str(&data.name);
+            write!(out, "{}", data.tls_passthrough)
+                .map_err(|err| GridError::backend(err.to_string()))?;
             for backend in &data.backends {
                 out.push_str(backend);
             }
-            write!(out, "{}", data.tls_passthrough)
-                .map_err(|err| GridError::backend(err.to_string()))?;
-            out.push_str(&data.network);
         }
         zos::GATEWAY_FQDN_PROXY_TYPE => {
+            // Matches the canonical Go ZOS implementation in
+            // pkg/gridtypes/zos/gw_fqdn.go: FQDN → TLSPassthrough → Backends.
             let data: GatewayFqdnProxyData =
                 serde_json::from_value(workload.data.clone()).map_err(GridError::from)?;
             out.push_str(&data.fqdn);
+            write!(out, "{}", data.tls_passthrough)
+                .map_err(|err| GridError::backend(err.to_string()))?;
             for backend in &data.backends {
                 out.push_str(backend);
             }
-            write!(out, "{}", data.tls_passthrough)
-                .map_err(|err| GridError::backend(err.to_string()))?;
-            out.push_str(&data.network);
         }
         other => {
             return Err(GridError::validation(format!(