feat(cli): manage experimental direct peer hosts

[M4n5ter]

English

Summary

• Ship release-mode direct-peer addons for macOS arm64, Linux x64/arm64, and Windows x64 in the immutable CLI package
• Bind peer enablement, stable identity, rotation, update preservation, descriptors, and cleanup to the existing managed Runtime Host service
• Configure the packaged addon automatically for CLI/TUI clients; descriptors expose only the pinned PeerId, Root ID, and candidate routes
• Keep Mesh membership, transit, and Desktop onboarding out of this change

Refs #3842

Verification

• npm run lint
• npm run format:check
• npm run typecheck
• npm run lint:runtime-host-peer
• Cargo formatting, generated SPDX dependency inventory, and cargo-deny license checks
• ASF header and CLI release policy checks
• Runtime Host peer and managed-service tests
• Offline install, native direct-peer ping/pong, and full controlled-turn smoke of a development CLI tarball containing the release addon
• Real macOS managed-service enable/disable/re-enable/rotate/uninstall lifecycle
• Real Linux x64 systemd managed-service lifecycle, followed by a macOS Client host.status request to that Host over direct peer with a real credential

The complete CLI suite passes all 510 tests.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and tested the change under maintainer direction. The commit carries the required Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

• 在不可变 CLI 包中分发 macOS arm64、Linux x64/arm64 与 Windows x64 的 release direct-peer addon
• 将 peer 启用、稳定身份、轮换、更新保留、descriptor 与清理纳入现有 managed Runtime Host service 生命周期
• 为 CLI/TUI Client 自动配置已打包 addon；descriptor 只暴露固定 PeerId、Root ID 与候选 route
• 本次不实现 Mesh membership、transit 或 Desktop onboarding

关联 #3842

验证

• npm run lint
• npm run format:check
• npm run typecheck
• npm run lint:runtime-host-peer
• Cargo 格式、生成的 SPDX 依赖清单与 cargo-deny license 检查
• ASF header 与 CLI release policy 检查
• Runtime Host peer 与 managed-service 测试
• 包含 release addon 的开发 CLI tarball 离线安装、native direct-peer ping/pong 与完整受控 Turn smoke
• macOS 真实 managed-service enable/disable/re-enable/rotate/uninstall 生命周期
• Linux x64 真实 systemd managed-service 生命周期，以及 macOS Client 使用真实 credential 经 direct peer 对该 Host 发起 host.status 请求

完整 CLI suite 的 510 项测试全部通过。

AI 使用

仅选择一项：

• 没有生成式工具作出实质贡献
• 生成式工具作出了实质贡献

工具及范围：Codex 在维护者指导下实现并测试了本变更；提交已包含要求的 Generated-by: Codex trailer。

检查清单

• 测试覆盖本次变更，并会在缺少本变更时失败
• lint、format、typecheck 与受影响测试均在本地通过

本 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[Astro-Han]

LGTM

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.