Run openXYOS provision as a FreeOS installer subprocess

[XYAIStudio]

Summary

Windows Setup still installs one FreeOS product. After the shell files are copied, NSIS nsExecs a shipped provisioner subprocess (provision-openxyos.ps1 / .cmd) and waits for exit 0.

That child process does the same job as a standalone openXYOS unpack-and-start: tar.exe into %LOCALAPPDATA%\FreeOS\openxyos, normalize nested openxyos\dist or flat dist, start FE/BE at medium integrity (IShellDispatch2 — never High-IL Node from the elevated installer), wait for http://127.0.0.1:3780/api/health/livez, and write .install-ready only when healthy.

This is not a second product install and not another round of NSIS FileWrite goto-label .cmd glue.

Parent (NSIS)

• Copies the sealed zip + provisioner + start helper.
• nsExec::ExecToLog the provisioner; one automatic retry on livez timeout (exit 12); MessageBox Retry for other failures.
• Failure text is the real step (zip / tar / extract / node / frontend / start / livez / marker). It does not default-blame “port 3780 occupied”.
• Soft-skip of livez is gone.

Child (provisioner)

• Idempotent extract + heal from $INSTDIR backups.
• One in-process start retry after a livez timeout.
• No HKCU Run / scheduled-task logon autostart. FreeOS starts openXYOS when FreeOS starts.

Organization

• Embeds http://127.0.0.1:3780 directly.
• No user-facing 「启动边车」 CTA.

Target branch

• Base is develop (feature / fix — default)
• Base is main (same as recent Windows installer PRs Fix Windows openXYOS install extract and native folder picker for source download #26–Fix NSIS installer abort when openXYOS livez is slow #33)

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation
• Refactor / chore
• Release / hotfix

Test plan

• uv run pytest tests/unit/desktop -q — 85 passed
• npx vitest run src/pages/Organization/sidecarRecover.test.ts
• npx tsc --noEmit in dashboard/
• make all (full ship bar; Linux VM cannot emit the Windows .exe)
• Added/updated tests (no FileWrite goto labels; provisioner contract; no logon autostart; Org embeds local URL)

Windows verify (CI windows-amd64 / local NSIS)

1. Build with wails3 task package so openxyos-runtime.zip is staged.
2. Run Setup. Details log should show the provisioner subprocess exit code, not extract-openxyos.cmd.
3. Confirm %LOCALAPPDATA%\FreeOS\openxyos has node\node.exe, openxyos\dist\index.html (or flat dist), .install-ready, and provision.log.
4. Confirm http://127.0.0.1:3780/api/health/livez is OK before Setup finishes.
5. Confirm no HKCU\...\Run\FreeOS-openXYOS and no FreeOS-openXYOS logon task.
6. Open FreeOS → Organization embeds http://127.0.0.1:3780 with no 「启动边车」 button.
7. If you force a bad zip / kill Node during Setup, the MessageBox should name extract / start / health-check — not “free port 3780”.

Checklist

• Updated CHANGELOG.md (if user-facing)
• README / docs updated (if needed)