Authenticate sockets by header or one-time ticket instead of ?token=

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

docs/code/workers.md

@@ -199,6 +199,12 @@ A token minted before tokens carried their labels and a `jti` is refused. Mint
 each existing worker host a new one with `POST /workers/tokens`, naming the
 labels it should carry, and swap it in for `FLUKSIO_WORKER_TOKEN`.
 
+**Upgrade the engine before its workers.** A worker sends its token as an
+`Authorization` header on the handshake, where it stays out of access logs, and
+an engine from before that reads it only from the URL: it refuses the newer
+worker at the handshake. The engine still takes the old `?token=` for one
+release, so older workers keep attaching to a newer engine meanwhile.
+
 ## Machines from a batch scheduler
 
 A cluster is not a machine that attaches and stays; it is a queue somebody else