fix(runtime): harden Crabfleet lifecycle boundaries

[vincentkoc]

Summary

• harden session lifecycle, authorization, runtime cleanup, credential rotation, and terminal delivery boundaries
• harden Share This Mac and RoyalVNCKit across registration ownership, teardown, clipboard/auth/parsing/input, and synchronized RFB Fence transitions
• pin coordinator and image supply-chain inputs, validate adapter routing at deployment time, and document connection-negotiated GitHub Actions runner framing

Validation

• ClawSweeper gpt-5.6-sol / high exact-range review pass 46: zero correctness or security findings; exact-head proof sufficient (fix-range-final-46)
• pnpm check
• pnpm test (897 tests)
• go test ./...
• go test -race ./...
• go test -race -count=100 ./internal/terminalws -run '^TestDialDoesNotApplyHTTPClientTimeoutToEstablishedConnection$'
• go vet ./...
• pnpm macos:test (91 vendor tests, 166 app tests)
• pnpm macos:bundle; signed arm64 app bundle built successfully
• make docs-site
• generated specification parity test generates ignored src/generated.ts before import and proves it matches docs/spec.md
• high-core generated-asset fixture proof serializes the two cross-process Vite builds without unsafe lock stealing; ten consecutive 32-worker runs passed
• pre-0040 SQLite upgrade proof migrates and reclaims an interrupted write-started credential namespace before retiring its obsolete lookup
• expired write-started credential rows remain reserved for recovery with their generation, claim, and rollback snapshot intact; active generations require the exact current lookup set
• rolling-upgrade regressions cover pre-0037 staged credential rows, historical lookup identities, mixed-version claim fencing, and stale rollback rejection after any newer legacy generation appears
• terminal regressions keep viewer acknowledgement timeouts passive; the documented runner sample fences queued steering by socket liveness and relay generation
• native macOS loopback regressions exercise RoyalVNCKit serving, UTF-8 clipboard/resize negotiation, teardown input quiescing, idle local-state checks, canceled auto-share preflight, descendant process-group cleanup, safe tokenless cleanup, relaunch cleanup, and cross-deployment/account recovery isolation
• focused native runtime proof passed the real loopback VNC server/client exchange, current-tailnet listener path, in-flight auto-share cancellation, and descendant process-group timeout path (4/4)
• real loopback WebSocket proof closes replacement attachments after late retired-writer failure and replays a control grant received between attachments
• exact-head terminal proof preserves delivery ambiguity across upstream close or error, runner disconnect, reader loss, and confirmation timeout after forwarding
• legacy desktop PUT and DELETE return explicit ownership conflicts for token-owned registrations; negative native recovery leaves a newer tokenless publisher intact
• VNC protocol regressions exercise complete fenced pixel-format/encoding transitions with protocol-required ZRLE resets, validate ARD safe-prime groups with bounded accepted-prime caching, and reject composite or degenerate Diffie-Hellman inputs
• Crabbox exact-head proof: provider aws, run run_4815f7384327, lease cbx_0fe193b21067
• pinned Crabbox v0.38.0 controller proof: repeated DELETE and restart-resumed provider stop passed
• default and explicit non-default Crabbox release archive SHA-256 verification
• immutable coordinator source revision verified upstream

Exact-head proof

Head: 75f76bf30973f4e66c94373fbdcb0d6a5f7b1c7e

pnpm check
All matched files use the correct format.

pnpm test
tests 897
pass 897
fail 0

go test ./... && go test -race ./... && go vet ./...
all packages passed

pnpm macos:test
RoyalVNCKit: 91 passed
CrabfleetMac: 166 passed

pnpm macos:bundle
signed arm64 Crabfleet.app built successfully

focused native runtime proof
loopback VNC + clipboard/resize: PASS
current-tailnet RoyalVNCKit listener: PASS
in-flight auto-share cancellation: PASS
descendant process-group timeout: PASS

make docs-site
Docs built successfully

pre-0040 SQLite crash-upgrade recovery: PASS
expired write-started registration recovery ownership: PASS
exact active lookup-set enforcement: PASS
late retired-writer loopback WebSocket close: PASS
between-attachment control-grant replay: PASS
runner-disconnect delivery ambiguity: PASS
upstream-close delivery ambiguity: PASS
upstream-error delivery ambiguity: PASS
post-write reader-loss delivery ambiguity: PASS
post-write confirmation-timeout delivery ambiguity: PASS
legacy token-ownership PUT/DELETE conflicts: PASS
negative native recovery preserves newer tokenless publisher: PASS
validated safe-prime cache eviction: PASS

Crabbox provider=aws run=run_4815f7384327 lease=cbx_0fe193b21067
exitCode=0 runStatus=succeeded leaseStopped=true
default release archive: OK
non-default release archive: OK

Pinned Crabbox v0.38.0 controller contract
TestControllerWorkspaceLifecycleAndIdempotency: PASS
TestControllerRestartResumesProviderStopAfterDurableLocalRevocation: PASS

Landing

Rebase merge required to preserve the 242 scoped commits because merge commits are disabled. Do not squash.

[vincentkoc]

GitHub rebase merge rejected this clean 242-commit PR with This branch can’t be rebased, while main remains the exact reviewed base. Landing the reviewed head 75f76bf30973f4e66c94373fbdcb0d6a5f7b1c7e as a fast-forward to preserve every commit and SHA. No squash and no merge commit.