Scheduled drift check for hard-coded demo key in endpoints/agent/main/etc/server.toml

[windcbf]

Background

Follow-up from #1677. The shipped default endpoints/agent/main/etc/server.toml hard-codes the public demo server's Curve25519 (and commented SM2) key. #1677 added an advisory drift check, but it lives in deploy-demo-v2.yml, which is workflow_dispatch-only — so drift is only surfaced (as a warning) during a manual demo deploy, buried in that run's log.

Problem

If nhp_server_public_key in the opennhp/demo secret is rotated without updating the committed file, a fresh nhp-agentd register/knock from the release archive silently fails the Noise handshake. Nothing catches this at PR time, on main, or on a schedule.

Proposal

Add a scheduled (cron) non-blocking workflow that:

• reads nhp_server_public_key / nhp_server_sm2_public_key from opennhp/demo,
• compares them against the active Curve line and commented SM2 line in endpoints/agent/main/etc/server.toml (reuse the active()/commented() matchers from deploy-demo-v2.yml),
• on drift, opens or updates a tracking issue (instead of only logging a warning).

Alternative considered: render the demo key from the secret at release-build time so it can't drift at all — heavier, but structurally eliminates the class.

Acceptance

• Drift is reported without requiring a manual demo deploy.
• No hard failure that could block unrelated CI.

🤖 Generated with Claude Code