Allow agent self-access to RunnersService.GetWorkload (unblocks expose list for in-workload CLI)

[rowan-stein]

Context

After deploying expose 0.1.5 + gateway identity propagation fixes, agents-orchestrator E2E now fails in go-core expose tests with:

• agyn expose list: permission_denied: runners authorization failed: permission denied

This happens because expose.ListExposures calls runners.GetWorkload as the agent identity, and runners.GetWorkload currently requires org-level can_view_workloads.

E2E run (example): https://github.com/agynio/agents-orchestrator/actions/runs/26468441507

Intended behavior

Agents should be able to list/manage exposures for their own workload when running agyn expose ... from inside the workload.

Proposal

Modify RunnersService.GetWorkload so that:

• if caller_identity_id == workload.agent_id, allow (self-access)
• otherwise require existing org-level can_view_workloads check

This is narrowly scoped and does not broaden org member visibility to all workloads.

Tasks

• Update agynio/runners/internal/server/workloads.go accordingly.
• Add tests:
  • allows agent self GetWorkload without calling/depending on org-level authz
  • still denies unrelated agent when org authz denies
  • preserves owner/admin behavior