fix(server): make GetDraftPolicy dual-auth so /wait works under OIDC

policy.local calls GetDraftPolicy from inside the sandbox supervisor
via the sandbox gRPC client, which authenticates with the shared
x-sandbox-secret. GetDraftPolicy was listed only in the Bearer-auth
scope table (config:read) and was not in SANDBOX_SECRET_METHODS or
DUAL_AUTH_METHODS, so OIDC-enabled gateways rejected those calls and
the /wait long-poll surfaced gateway_lookup_failed. Local/no-OIDC
setups happened to work because the auth check is short-circuited.

Add GetDraftPolicy to DUAL_AUTH_METHODS, matching the existing
GetSandboxConfig pattern (called by both CLI reviewer surfaces with
Bearer and the sandbox supervisor with x-sandbox-secret). Dual-auth
short-circuits the scope check for sandbox-secret callers, so the
config:read entry in authz.rs continues to gate Bearer-only flows.

Mirror the openshell_get_sandbox_config_is_dual_auth assertion for
GetDraftPolicy.

Note: ssh_handshake_secret is server-wide, not per-sandbox, so a
sandbox-secret caller can today name any sandbox in a SubmitPolicyAnalysis
request — and now in a GetDraftPolicy request. The exposure is
symmetric with the existing SANDBOX_SECRET_METHODS pattern. Filed as a
follow-up: per-sandbox secret binding, tracked separately.

Signed-off-by: Alexander Watson <zredlined@gmail.com>

Author: zredlined

crates/openshell-server/src/auth/oidc.rs

@@ -56,9 +56,13 @@ const SANDBOX_SECRET_METHODS: &[&str] = &[
 /// (policy/settings mutations) and the sandbox supervisor (policy sync on
 /// startup). `OpenShell/GetSandboxConfig` serves CLI settings reads while
 /// remaining compatible with sandbox-secret-authenticated callers.
+/// `GetDraftPolicy` serves CLI reviewer surfaces (`openshell rule get`,
+/// TUI inbox) AND the sandbox-side `policy.local /wait` long-poll that
+/// blocks on the agent's proposal until the developer decides.
 const DUAL_AUTH_METHODS: &[&str] = &[
     "/openshell.v1.OpenShell/UpdateConfig",
     "/openshell.v1.OpenShell/GetSandboxConfig",
+    "/openshell.v1.OpenShell/GetDraftPolicy",
 ];
 
 /// Returns `true` if the method accepts either Bearer or sandbox-secret auth.
@@ -495,6 +499,21 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn openshell_get_draft_policy_is_dual_auth() {
+        // policy.local calls GetDraftPolicy with x-sandbox-secret (from
+        // inside the sandbox supervisor), and the CLI/TUI reviewer
+        // surfaces call it with an OIDC Bearer. Sandbox-secret-only
+        // would lock CLI out; Bearer-only would 401 the /wait long-poll
+        // in OIDC-enabled deployments.
+        assert!(!is_sandbox_secret_method(
+            "/openshell.v1.OpenShell/GetDraftPolicy"
+        ));
+        assert!(is_dual_auth_method(
+            "/openshell.v1.OpenShell/GetDraftPolicy"
+        ));
+    }
+
     #[test]
     fn sandbox_secret_validation() {
         let mut headers = http::HeaderMap::new();