POST /code/runtimes/{runtimeId}/token

POST /api/v1/code/runtimes/{runtimeId}/token on the Caveman Cloud control plane. Authenticated by the body: an Ed25519 signature, with the runtime's enrolled key, over "caveman-code-runtime-token/v1\n<organization_id>\n<runtime_id>\n<issued_at>" (issued_at in Unix seconds, within 60 s of now and later than the last one used). Rate-limited per address. Not exposed to autonomous agents: Not RBAC-guarded — authenticated by a Caveman Code runtime token or by the enrolled key's signed assertion that mints one. Agents authenticate through a scoped control-plane session and never touch these directly.