MCP presenter: public host ensure/handoff cannot enable presenter enforcement, so desktop cannot enroll #4247

S1 — Public host launch cannot select presenter enforcement

Blocking the normal desktop launch integration.

The pieces exist but do not join:

1. host-command-args.ts:66-68 recognizes fd 4, but :90-119 rejects the separate --mcp-presenter-enforcement option.
2. Ordinary agent CLI parsing recognizes that enforcement flag (packages/coding-agent/src/cli/args.ts:330-334).
3. packages/coding-agent/src/modes/rpc/host-runner.ts:165-172,275-282 passes only spec.hostArgs and the bootstrap stream.
4. Launch-spec resolution constructs only session-runtime and extension arguments (packages/coding-agent/src/modes/rpc/host-launch-spec.ts:29-42,94-104); it cannot carry the deployment enforcement option.
5. Initial/successor launches forward --mcp-presenter-fd 4, but do not add enforcement (packages/coding-agent/src/modes/rpc/host-ensure-start.ts:79-103; packages/coding-agent/src/modes/rpc/host-successor.ts:108-140).
6. The host explicitly requires both a bootstrap fd and mcpPresenterEnforcement === true, otherwise it destroys the bootstrap stream (packages/coding-agent/src/modes/rpc/multi-session-host.ts:361-374).

Therefore, the desktop cannot complete enrollment merely by adding fd 4 to its existing host ensure call. This conclusion is from the complete source path, not an executed process reproduction. An embedder supplying enforcement in hostArgs, or a directly launched enforcing multi-session host, can use the external protocol today; desktop must not bypass its engine-owned supervisor to do that.

Small engine PR: add an explicit deployment option to public ensure/handoff and carry it through initial, immediate successor and deferred idle successor launch. Keep it out of project settings, environment capability strings and secret-bearing launch-spec fields. Defaults remain off. Reusing a host must never enroll the caller or silently claim that enforcement is active. An unchanged runtime build is not evidence of the requested policy: packages/coding-agent/src/modes/rpc/protocol-identity.ts:47-59 hashes extensions/multi-session/runtime, not this option. Use actual protocol support/ownership and a coordinated migration, not a forced restart.

Exact files: packages/coding-agent/src/cli/host-command-args.ts, packages/coding-agent/src/cli/host-command.ts, packages/coding-agent/src/modes/rpc/host-runner.ts, host-ensure-types.ts, host-ensure-start.ts, host-successor.ts, host-handover-wire.ts, with focused existing host CLI/launch tests and test/mcp/presenter-bootstrap.test.ts. Preserve the supervisor import-budget boundary.

RED: host ensure reaches enrolled with explicit enforcement and fd 4; immediate and deferred handoff preserve enforcement and require fresh enrollment; reuse does not enroll or upgrade a foreign busy host. Today public parsing/launch cannot activate the required mode. Exercise the real public CLI, not only the existing relay fixture.

Related: #4197, #4210 (merged), sisyphuslabs/omo-desktop-app#4370. Found while planning the desktop presenter integration.