feat(runtime-host): expose fenced Bash in managed coding

[zhiiw]

Summary

Expose a foreground-only fenced Bash tool in the canonical managed-coding-v2 product profile.

The Runtime remains the sole owner of the one-shot operation capability and provider result. Runtime Host admits the effect only after materializing the exact accepted tree into a disposable execution root and proving an enforcing platform sandbox. The surface rejects background execution, PTY, caller-selected paths, and boundary overrides. Windows continues to report the profile unavailable because arbitrary-shell AppContainer evidence is not yet complete.

This slice also:

• reclaims Host-crash residue only from the canonical unpublished managed-disposable-executions-v2 namespace;
• enforces one disposable-root owner per storage-root capability, preventing two owners from deleting each other's live roots;
• adds a production-shaped Host kill/restart gate that proves a completed ShellRun is not replayed;
• records the managed compatibility budget: unpublished v1/v3/v4 shapes have no readers or migrations, while released schema-14 and ordinary continuation facts retain their real compatibility contracts.

Invariant

A managed Bash call can execute only once, in a disposable materialization of the exact accepted tree, behind a T1-frozen external-effect fence and an enforcing foreground command sandbox. A Host restart adopts durable ShellRun evidence and never auto-replays the effect.

Owner: Runtime owns the linear operation/result; Runtime Host owns accepted-tree materialization and sandbox admission; ShellRun owns terminal effect evidence.

Atomic boundary: T1 freezes the external-effect descriptor before the operation capability can run. ShellRun terminal adoption is the only recovery path after an uncertain Host response.

Failure state: missing sandbox/admission fails before T1; uncertain post-T1 state parks instead of falling back or replaying.

Rollback: disable profile advertisement. Durable facts remain readable and no attached-checkout fallback exists.

Validation

• Core, Runtime, and Runtime Host builds pass.
• Focused Runtime Host owner/profile tests: 12 passed.
• Managed Bash builder test: 1 passed.
• The packaged three-platform crash gate is scheduled by gitoxide-helper-admission.yml.
• Local Windows run explicitly skips the POSIX product path because the packaged Gitoxide helper is not configured; Windows remains unavailable by contract.

中文说明

摘要

把受约束的前台 Bash 接入唯一的 managed-coding-v2 产品 profile。

Runtime 继续独占一次性 operation capability 和 provider result；Runtime Host 只有在把 exact accepted tree 物化到一次性目录，并证明平台 sandbox 能强制执行后，才允许 Bash 运行。该工具明确拒绝后台、PTY、调用者指定 cwd 和 boundary override。Windows 因任意 shell 的 AppContainer 证据尚未闭环，继续不广告该 profile。

本切片同时完成：

• 只回收 canonical、未发布的 managed-disposable-executions-v2 namespace 中的 Host 崩溃残留；
• 同一 storage-root capability 只允许一个 disposable-root owner，避免两个 owner 互删活跃目录；
• 增加真实 Host kill/restart gate，证明已完成 ShellRun 不会重放；
• 写清兼容预算：未发布的 v1/v3/v4 没有 reader/migration；正式 schema 14 与普通 continuation facts 保留真实兼容合同。

主要不变量

managed Bash 只能执行一次，只能运行在 exact accepted tree 的 disposable materialization 中，并且必须先经过 T1 冻结的 external-effect fence 与可强制执行的前台 command sandbox。Host 重启只能采用 durable ShellRun evidence，绝不自动重放副作用。

缺少能力时在 T1 前失败；T1 后状态不确定时 park，不 fallback、不重放、不触碰 attached checkout。

验证

• Core、Runtime、Runtime Host 构建通过；
• Runtime Host owner/profile 定向测试 12 项通过；
• managed Bash builder 测试 1 项通过；
• 三平台 packaged crash gate 已进入统一 workflow；
• 本机 Windows 因未配置 packaged Gitoxide helper 明确 skip POSIX 产品路径，且 Windows 依合同保持 unavailable。