feat(runtime-host): attest the bundled npm runtime

[zhiiw]

Summary

Attests the packaged npm runtime before it can issue the process-local capability consumed by managed provisioning. The attestation binds platform, architecture, Node/npm versions, declared runtime files, and the fixed execution policy; every managed invocation revalidates the declared runtime tree.

Trust boundary

The manifest proves runtime integrity inside an already authorized release resource root; it is not a standalone provenance trust root. Provenance comes from the outer signed application and release/update chain. If an attacker can replace both the packaged npm tree and its manifest, this layer alone cannot distinguish that tree from a Maka release.

Primary invariant

No path, version string, or caller-constructed object can self-authorize npm provisioning. Only a process-local capability issued after bundled-runtime attestation can cross the producer boundary.

• Owner: Runtime Host bundled npm attestation authority
• Failure state: invalid or changed runtime evidence fails closed before operational-root acquisition
• Rollback: remove bundled npm preparation/attestation; the constrained producer remains unreachable from production composition

Verification

The release verifier runs the actual bundled npm against a hermetic loopback registry and installs a tarball fixture with a real bin declaration. Producer tests also cover the fixed permission profile and Windows long-path HOME handling.

Stack

1. durable dependency artifact authority
2. constrained npm producer
3. This PR: bundled npm runtime attestation
4. cancellable managed admission authority
5. production managed inspection task + crash/replay proof

中文说明

本切片在 managed provisioning 前验证随包发布的 npm runtime，并签发进程内不可伪造的 capability。验证绑定平台、架构、Node/npm 版本、完整文件清单与固定执行策略；每次调用都会重新验证 runtime tree。

这里明确区分两层信任：外层应用签名与发布/更新链提供来源信任，manifest 只证明已授权资源目录内的运行时完整性。manifest 本身不是独立的密码学信任根。

验收测试使用真实 bundled npm，从本地 hermetic registry 安装带 bin 的 tarball fixture，并覆盖 Windows 长路径 HOME 的执行边界。

[zhiiw]

Closed as an obsolete extraction/integration slice. The current delivery path is the merged Gitoxide foundation followed by #40 -> #41 -> #42. This PR remains available as design and implementation history.

中文说明

该 PR 属于旧 extraction/integration 栈，现已失去独立合并价值。当前交付路径是已合并的 Gitoxide 基础，然后依次审查 #40 → #41 → #42。这里继续保留设计、实现与审查历史。