feat(runtime-host): add crash-safe managed workspace inspection

[zhiiw]

Stacked Draft: depends on #2622. Until the lower slices merge, GitHub's upstream comparison is cumulative. Do not merge this PR before #2622.

Summary

Adds the first dedicated production consumer for the managed dependency execution profile: the read-only ManagedWorkspaceInspect task. Runtime Host owns packaged Git/npm admission, workspace admission, dependency provisioning, worker routing, cancellation, drain, and exact replay through one explicit composition.

Primary invariant

A replay-safe managed inspection is admitted once against one canonical workspace baseline and one attested dependency artifact. A Host crash after durable receipt publication must converge on reopen without duplicating baseline, artifact, or receipt state.

• Owner: Runtime Host production execution composition
• Atomicity boundary: durable managed admission + dependency receipt; the provider-facing result is emitted only after the read-only operation completes
• Failure state: cancellation, source drift, invalid profile, unavailable authority, or packaged-resource delegation mismatch fails closed; there is no attached-checkout fallback
• Rollback: remove the dedicated tool registration and composition consumer; lower capabilities remain dormant

Packaged resource trust boundary

The fd3/PID/path bootstrap is direct-parent application delegation, not a platform signature or cryptographic identity proof. The provenance trust root is the outer signed application and release/update chain. Public CLI input and ambient paths cannot claim bundled resources, but a malicious same-user process able to launch arbitrary Electron parents, manufacture inherited descriptors, and replace application resources is outside the v1 threat model.

Verification

• Code Mode, Core, Storage, Runtime, and Runtime Host builds/typecheck passed.
• Production composition runs actual bundled npm, installs pinned semver@7.7.3, verifies the generated platform .bin, and reads the leased dependency rather than attached node_modules.
• A real child-process test kills the Host after the dependency receipt becomes durable, reopens the same task, and verifies one canonical baseline, artifact, receipt, and replay result.
• Protocol capability admission and Plan Mode exclusion tests passed.

Stack

1. durable dependency artifact authority (feat(storage): add managed dependency artifact authority #2485, merged)
2. constrained npm producer (feat(runtime-host): constrain managed npm dependency provisioning #2620)
3. bundled npm runtime attestation (feat(runtime-host): attest the bundled npm runtime #2621)
4. owner-bound and cancellable managed admission authority (feat(storage): bind and cancel managed dependency admission #2622)
5. This PR: production managed inspection task + crash/replay proof

中文说明

**堆叠 Draft：**依赖 #2622。前置切片合并前，上游比较会暂时显示累计 diff；请勿提前合并。

本切片加入第一个生产消费者 ManagedWorkspaceInspect，把 packaged Git/npm、workspace admission、dependency provisioning、只读 worker 路由、取消、drain 与 crash replay 接成一条明确链路。

fd3/PID/path 只负责直接父子进程之间的应用委托，不是平台签名或密码学身份验证。真正的来源信任根是外层已签名应用与发布/更新链。

验收使用真实 bundled npm 安装固定依赖并验证 .bin，同时在 dependency receipt durable 后杀死 Host，重开后证明 baseline、artifact、receipt 与只读结果均唯一收敛。

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5cc85a47-8894-4fb1-a1d1-02ec3414db63

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[zhiiw]

Rebased this Draft on the rebuilt admission/cancellation stack and current main.

This rebase intentionally does not restore the retired packaged-Git/Runtime-Host profile seam. Six old commits that depended on that seam were dropped. The remaining composition and inspection implementation stays dormant (no production tool registration) until the Gitoxide admission path supplies a real consumer. Focused dormant composition/inspection tests pass (12 passed); production-shaped Windows dependency tests remain subject to the existing ADS/fsutil environment issue.

中文说明

该 Draft 已基于重建后的 admission/cancellation 堆栈与最新主线更新。本次有意不恢复已经废弃的 packaged-Git / Runtime Host profile seam，并删除了依赖该 seam 的 6 个旧提交。保留的 composition/inspection 实现维持 dormant 状态，不注册生产工具，等待 Gitoxide admission 路径提供真实 consumer。定向 dormant 测试为 12 通过；Windows 的 production-shaped 依赖测试仍受现有 ADS/fsutil 环境问题影响。

[zhiiw]

Closing this Draft as superseded.

The production managed-workspace composition has been rebuilt around the Gitoxide data plane. The design discussion and crash/replay findings here remain useful, but the bundled-Git-era branch will not be merged or developed further.

Replacement:

• feat(runtime-host): compose isolated Gitoxide workspace inspection zhiiw/maka-agent#24

中文说明

关闭此 Draft，标记为已被新实现替代。

production managed-workspace composition 已围绕 Gitoxide 数据面重新构建。本 PR 的设计讨论以及 crash/replay 审查记录仍会保留，但 bundled Git 时期的分支不会继续开发或合并。

替代实现：

• feat(runtime-host): compose isolated Gitoxide workspace inspection zhiiw/maka-agent#24