feat(supervisor): export workload_token_enforcement_mode gauge

Emit a gauge set to 1 for the active WORKLOAD_TOKEN_ENFORCEMENT value (disabled/
log/enforce) so dashboards can show the current mode at a glance. The existing
verify/mint counters don't distinguish log from enforce; this closes that gap.

Author: nicktrn

apps/supervisor/src/workloadToken.ts

@@ -4,7 +4,7 @@ import {
   type WorkloadDeploymentTokenClaims,
   type WorkloadDeploymentTokenInput,
 } from "@trigger.dev/core/v3";
-import { Counter } from "prom-client";
+import { Counter, Gauge } from "prom-client";
 import { env } from "./env.js";
 import { register } from "./metrics.js";
 
@@ -37,6 +37,16 @@ const verifyCounter = new Counter({
   registers: [register],
 });
 
+// Exports the active mode (value 1 for the current WORKLOAD_TOKEN_ENFORCEMENT) so dashboards can show
+// disabled/log/enforce at a glance — the counters alone don't distinguish log from enforce.
+const enforcementModeGauge = new Gauge({
+  name: "workload_token_enforcement_mode",
+  help: "Active runner-boundary auth mode: value 1 for the label matching WORKLOAD_TOKEN_ENFORCEMENT",
+  labelNames: ["mode"] as const,
+  registers: [register],
+});
+enforcementModeGauge.set({ mode: env.WORKLOAD_TOKEN_ENFORCEMENT }, 1);
+
 export async function mintDeploymentToken(
   claims: WorkloadDeploymentTokenInput
 ): Promise<string | undefined> {