Fix agent worker API config, not_met enum warning, and untrusted workspace

[xrendan]

Summary

Fixes the issues seen in the production worker logs on 2026-09-10:

• not_met enum warning — Rails auto-generates a not_met negative scope for the met value, colliding with the real not_met status. Criterion.status now uses scopes: false. Predicates (met?, not_met?) are unchanged; no class-level scopes were in use.
• Agent could not reach the Rails API — since the GoodJob worker moved to its own container (Add production docker-compose with separate GoodJob worker #125), RAILS_API_URL defaulted to localhost:3000, which is not the web container. The worker now defaults it to http://web:3000 (overridable).
• RAILS_API_KEY not set — neither container passed AGENT_API_KEY through. Both services now do; the worker also passes AGENT_MODEL.
• "workspace has not been trusted" warning — the Dockerfile seeds /home/rails/.claude.json with /rails/agent trusted so agent/.claude/settings.json permissions are honoured.
• Jobs logged "Success" while blocked — Claude exits 0 even when it can't reach the API. The duplicated subprocess plumbing in AgentEvaluateCommitmentJob and AgentProcessEntryJob is extracted into a RunsClaudeAgent concern with a preflight that checks the API key is present and /up responds. Misconfiguration now raises and goes through the existing retry_on path instead of launching an agent.

Deploy notes

• Set AGENT_API_KEY in the deploy environment (production credentials don't carry agent.api_key). It's a shared secret you generate, e.g. openssl rand -hex 32; the same value on web and worker.
• Not fixed here: the GEMINI_API_KEY in production has been suspended by Google. The RubyLLM registry refresh and every Gemini-backed pipeline (criteria generation, dedup, extraction, target dates) will keep failing until the key is rotated. The refresh can't just be removed — the pinned ruby_llm fork's bundled model list has no gemini-3.1 models.

Testing

• bin/rubocop — no offenses
• New tests: enum predicates / no scope collision; both jobs schedule a retry with ConfigurationError / ApiUnreachableError before launching the agent
• Full suite: 2 failures — both are StatCan schedule tests that also fail on unmodified main (time-dependent, unrelated)
• Verified the enum warning no longer prints at boot