完成 WebSocket 与 workspace 架构优化收尾，并修复全量回归阻塞。

本次将握手鉴权、Origin 校验、限流、重连补偿、发送背压与观测字段打通，同时修复 gateway 异常路径与备份清理兼容问题，确保工具历史压缩语义一致并恢复全量测试通过。

Made-with: Cursor

interfaces/ws/runtime_loop.py

@@ -11,6 +11,9 @@ async def close_ws(conn: Any, code: int = 1000, reason: str = "done") -> None:
 
 
 async def run_connection_loop(conn: Any) -> None:
+    if hasattr(conn, "validate_origin") and not conn.validate_origin():
+        await close_ws(conn, 1008, "origin not allowed")
+        return
     await conn.ws.accept()
     await conn.send_event("connect.challenge", {"nonce": conn.connect_nonce, "ts": conn._now_ms()})
     while True: