feat(runtime-host): compose isolated Gitoxide workspace inspection

[zhiiw]

Primary invariant

ManagedWorkspaceInspect may expose source bytes only from a fresh projection of the exact Gitoxide-admitted tree, and dependency bytes only from the durable environment lease derived from that same tree's package.json and package-lock.json. Missing capabilities fail closed before the tool is exposed; there is no attached-checkout, system-Git, or PATH fallback.

Ownership and boundaries

• Packaged release owner: attested Gitoxide helper and npm runtime artifacts.
• Gitoxide owners: exact source admission, bare import, immutable tree reads, and projection observation.
• Dependency authority: manifest/lockfile identity, durable receipt, and active lease.
• Filesystem worker: one read-only Read/Glob operation.
• Runtime Host: tool visibility, routing, cancellation, draining, and cleanup.

The operation is intentionally custom_tool and never_auto_retry: provisioning has side effects and M1.3 does not claim M2 mutation recovery.

Failure and rollback

Each invocation uses a fresh random import/projection root. Any admission, provisioning, worker, or projection-observation failure suppresses the provider result and removes the ephemeral root. The dependency lease is always released. A process crash may leave untrusted random staging residue for later GC, but no later invocation reuses it.

Verification

• Core, Storage, Runtime, and Runtime Host builds pass locally.
• Fast product test proves Plan Mode exclusion and rejects dot-dot dependency aliases before Git/npm work.
• The Gitoxide three-platform workflow runs the product composition against the real helper.
• Existing packaged npm release verification exercises a hermetic tarball, extraction, and .bin generation.
• ASF header audit and git diff --check pass.

Delivery status

This is an integration Draft. Its base branch is an explicit prerequisite join point for review only. After prerequisite PRs merge, this change must be rebuilt flat from the latest main; the integration base is not a merge target.

中文说明

主要不变量

ManagedWorkspaceInspect 的源码只能来自 Gitoxide 精确接纳 tree 的 fresh projection；依赖只能来自同一 tree 中 package.json 与 package-lock.json 所确定的 durable environment lease。能力缺失时工具不会进入 Host tool surface，禁止回退 attached checkout、系统 Git 或 PATH Git。

Owner 与边界

• 发布物 owner：经过验证的 Gitoxide helper 与 npm runtime；
• Gitoxide owner：source admission、bare import、immutable tree read 与 projection observation；
• dependency authority：manifest/lockfile identity、durable receipt 和 active lease；
• filesystem worker：一次只读 Read/Glob；
• Runtime Host：工具可见性、路径路由、取消、drain 和清理。

该工具明确为 custom_tool 与 never_auto_retry：依赖安装有副作用，M1.3 不冒充尚未完成的 M2 mutation recovery。

失败与回滚

每次调用使用 fresh 随机 import/projection root。admission、provisioning、worker 或 projection observation 任一步失败都不发布 provider result，并清理临时 root；dependency lease 始终释放。进程崩溃可能留下等待后续 GC 的随机 staging，但后续调用绝不复用。

验证与交付

本地四个 workspace build、Plan Mode/路径边界快测、ASF header 与 diff check 已通过；三平台 CI 会用真实 Gitoxide helper 执行产品组合测试。该 PR 是 integration Draft，base 只是前置 join point。前置 PR 合并后必须从最新 main 平铺重建，不能直接合并 integration base。

[zhiiw]

Closed as an obsolete extraction/integration slice. The current delivery path is the merged Gitoxide foundation followed by #40 -> #41 -> #42. This PR remains available as design and implementation history.

中文说明

该 PR 属于旧 extraction/integration 栈，现已失去独立合并价值。当前交付路径是已合并的 Gitoxide 基础，然后依次审查 #40 → #41 → #42。这里继续保留设计、实现与审查历史。