feat(runtime-host): compose managed Node transform profile

[zhiiw]

Summary

Composes the managed Node workspace-transform kernel into a packaged Runtime Host profile and makes Desktop select it only through pre-Session capability negotiation.

Main invariant

A Desktop task may enter managed-coding-v4 only when the resident Host owns the exact packaged Gitoxide helper, canonical toolchain release v4, enforcing sandbox, and transform admission owner before Session creation. Once frozen, the Session cannot downgrade to an earlier profile or fall back after T1.

Product composition

• Release manifest v4 binds hermetic_observation_v2, hermetic_observation_v3, and workspace_transform_v1.
• Host profile v4 is v3 plus exactly ManagedNodeTransform.
• Write, Edit, and ManagedNodeTransform all bind the single canonical mutation execution-profile v2 digest.
• Desktop automatically selects the highest resident Host profile before creating the Session.
• Existing v1/v2/v3 Session headers retain their exact tool surfaces and never gain transform authority.

Crash boundary

The production-shaped gate starts the packaged Electron Host with a real Gitoxide helper, invokes the real transform through ToolRuntime, waits until SQLite commits T2/successor, kills the Host before the assistant turn finishes, then restarts and continues. It asserts one call, one response, one successor, zero reservations, and no transform replay.

Platform matrix

• Linux/macOS: v4 is advertised only with release manifest v4 and enforcing sandbox; the real kill/reopen gate runs in CI.
• Windows: Electron is not admitted as an independent Node runtime, so the Host advertises v1 only and v4 fails closed.
• Contract: process-crash convergence; no hardware power-loss exactly-once claim.

Verification

• Builds: core, storage, runtime, runtime-host, full Desktop
• Focused product/session suite: 204 passed, 5 expected platform/helper skips
• Toolchain preparation tests: 2/2
• Biome lint and git diff --check

中文说明

摘要

本 PR 把 managed Node workspace-transform kernel 接入 packaged Runtime Host profile；Desktop 只能通过 Session 创建前的 Host capability negotiation 选择它。

主要不变量

只有 resident Host 在 Session 创建前同时拥有 exact packaged Gitoxide helper、canonical toolchain release v4、enforcing sandbox 和 transform admission owner，Desktop task 才能进入 managed-coding-v4。profile 一旦冻结，运行中禁止降级，也禁止 T1 后 fallback。

产品组合

• release manifest v4 同时绑定 hermetic_observation_v2、hermetic_observation_v3 与 workspace_transform_v1；
• Host profile v4 等于 v3 加且只加 ManagedNodeTransform；
• Write、Edit、ManagedNodeTransform 统一绑定 canonical mutation execution profile v2 digest；
• Desktop 在创建 Session 前自动选择 resident Host 宣告的最高 profile；
• 已有 v1/v2/v3 Session header 保持原有工具集合，不会获得 transform 权限。

崩溃边界

production-shaped gate 使用 packaged Electron Host 和真实 Gitoxide helper，经 ToolRuntime 执行真实 transform；SQLite 提交 T2/successor、assistant turn 尚未结束时杀死 Host，再重启 continuation。测试要求只有一个 call、一个 response、一个 successor、零 reservation，且 transform 不得重放。

平台矩阵

• Linux/macOS：只有 manifest v4 + enforcing sandbox 成立时才宣告 v4，CI 运行真实 kill/reopen；
• Windows：Electron 不被当作独立 Node runtime，Host 只宣告 v1，v4 fail closed；
• 只承诺 process-crash convergence，不宣称断电 exactly-once。

验证

• core/storage/runtime/runtime-host/Desktop 全部构建通过；
• product/session 定向套件 204 通过，5 个平台/helper 预期跳过；
• toolchain preparation 2/2；
• Biome lint 与 git diff --check 通过。