Allow Python workers to start with worker-only credentials

[rmcdaniel]

Problem

A Python Worker reads GET /api/cluster/info before it registers. The Server intentionally permits that discovery route to worker, operator, and admin credentials, but the Python client currently classifies the request as control-plane and rejects a client configured with only worker_token before any HTTP request is sent.

A worker process therefore cannot start with its least-privilege worker credential. It must also receive a control credential or a shared credential, even though registration, polling, heartbeat, and graceful deregistration are worker-plane operations.

Required behavior

Treat cluster discovery as an explicitly authenticated discovery operation that a worker credential can call, without allowing worker credentials to authorize control-plane management methods.

Acceptance criteria

• Worker(Client(..., worker_token="...")) can read compatible cluster information, register, poll, heartbeat, and gracefully deregister without a control or shared credential.
• Cluster discovery selects an available role-appropriate credential explicitly; it does not restore general fallback between worker and control credentials.
• Control-plane methods still reject a worker-only client before transport, and worker-plane methods still reject a control-only client before transport.
• Focused tests exercise worker startup and shutdown with only worker_token, assert the discovery request is authenticated with that token, and retain both wrong-plane rejection cases.
• Documentation shows separate worker-process and control-process credential construction without placing both scoped credentials in the worker process.

Delete when

Delete when main and a published Python SDK prerelease support a complete worker lifecycle with only a worker-scoped credential while preserving fail-closed credential separation for actual control-plane operations.