fix(cli): repair legacy Host controls before update

[M4n5ter]

Summary

English

Desktop recovery could not replace a managed Runtime Host installed before #4657: strict projection verification required operator.mjs and the current reconciliation scheduler before the updater had a chance to create them.

Repair those update-control artifacts under the deployment lock before strict verification. The running Host supervisor remains untouched until the existing retirement and active-work policy permits replacement.

中文

在 #4657 之前安装的托管 Runtime Host 仍使用旧的 shell operator 和旧版定时更新配置。Desktop 恢复流程会先按新格式严格校验这些文件，因此还没来得及升级就直接失败，用户点击“停止 Host 并继续”也无法恢复。

本 PR 在 deployment lock 内先修复 operator 和定时更新配置，再做严格校验。这个步骤不会提前停止或替换正在运行的 Host，后续仍由现有的任务保护和退出策略决定何时切换。

Verification

• npm exec -- biome check packages/cli/src/runtime-host-lifecycle-transaction.ts packages/cli/src/runtime-host-update-command.ts packages/cli/src/__tests__/runtime-host-selected-update.test.ts packages/cli/src/__tests__/runtime-host-lifecycle-transaction.test.ts
• npm --workspace maka-agent run typecheck
• npm --workspace maka-agent run build
• node --test packages/cli/dist/__tests__/runtime-host-selected-update.test.js packages/cli/dist/__tests__/runtime-host-lifecycle-transaction.test.js (18 passed)
• Reproduced with a pre-refactor(runtime-host): make operator control platform-neutral #4657 macOS launchd deployment, then confirmed Desktop reported managed Local Host repair result: repaired; the replacement Host and reconciliation timer were both active afterward.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex diagnosed the legacy projection mismatch, implemented the repair ordering, and added focused regression coverage.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[jackwener]

Approved at exact head 9e180a774cc5a42d1b5b8b7167e3584dfb100818 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

---

Review notice: This approval was submitted by an automated review agent operated by jackwener and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.