fix: authenticate runtime IPC and scrub subprocess credentials

[Raghav-Bansal-15]

The runtime must match the authenticated host transport rather than advertise compatibility with old plaintext hosts.

Require IPC 1.1.0 in both dependency configuration and the packaged manifest, retain the exact security marker, and pin CI to companion host 1ccec3f6e8d29c93ec686f0285b85be5a35306b8.

Validation at 303eddb: 262 tests and the paired fatJar build pass locally. A packaged-manifest regression verifies that the old host version is rejected. Current-head three-OS CI passed. This is a coordinated host/runtime change, not authorization to release the runtime as generic latest.

Original and reviewer commits are preserved. Upstream workflow approval and required checks are separate gates; no merge or release.

Native-image follow-up: protobuf descriptors now initialize at runtime to avoid the macOS build-time initialization cycle. Current head 303eddb; local IPC tests/JVM smoke/quality and paired runtime build pass. Current-head three-OS runtime build/tests passed; companion-host native checks remain separate.

Hosted evidence: Build.

[kshivang]

@claude Please review this PR against its latest head commit. Check correctness, regressions, security, and test coverage, and report any actionable findings so they can be fixed before merge.

[kshivang]

Codex self-review fallback completed at 44f0d1d4f8bdc5f6aa704bb1b4e2f84583c23d7a: no actionable runtime defect identified; no source changes made. Exact-head fork CI passed 261 tests on each of Linux, macOS, and Windows (uploaded XML: zero failures/errors/skips), including packaged TLS authentication and subprocess credential scrubbing.

Known readiness blockers at the last check: upstream Build requires maintainer action; companion BossConsole #575 remains draft with unresolved recovery work and incomplete current-head validation. Maintainers should approve/run upstream CI, complete the companion host work, and coordinate authenticated host/runtime distribution before merge/release. Claude was unavailable; this is a Codex self-review, not an independent Claude review. No further implementation or investigation is underway.

[Raghav-Bansal-15]

Updated paired CI to the final repaired host 06e73dd14fbff4667fc7bcae7640bea1ae6acdcf and aligned the plugin API to 1.0.90. The local paired build/fat JAR and all 261 runtime tests pass (zero failures/errors/skips).

The companion host PR is now ready for review. Latest-head cross-platform CI still needs completion, and upstream workflow approval plus coordinated distribution/minimum-host-version assignment remain maintainer gates. Nothing has been published or merged.

[kshivang]

Focused readiness update at d98614e1d33ce21e2e4f4ac7b3db6317627ceaad: the only changes since the prior runtime review are the paired host CI pin and plugin API alignment to 1.0.90. Current-head fork Build succeeds. No additional runtime source defect identified in this focused check; no new code changes or builds performed.

Blocked on external gates: the upstream Build still requires maintainer action. BossConsole #575 is now non-draft and reports the recovery fix and passing fork CI, superseding the earlier draft/recovery-blocker handoff, but remains open. Maintainers should approve upstream CI and complete the paired host readiness decision; assign the minimum host version and coordinate compatible distribution before enabling runtime release. The runtime CI pin is 06e73dd14fbff4667fc7bcae7640bea1ae6acdcf; the latest host head is b282a901a5925a4aec2f4b5db341d0083db84b05, so final integration must account for that distinction. Stopping here rather than expanding into host work. No merge or deployment performed.

[Raghav-Bansal-15]

Follow-up at 1341900d: The packaged manifest and dependency now require IPC 1.1.0. CI is pinned to final host 4f209d77decdbc58b3144ea2eb228b52d8e3abc4. All 262 tests and fatJar assembly pass locally against that host, including an assertion that the packaged minimum rejects a 1.0.0 host. No standalone runtime release is requested.

Original and reviewer commits are preserved. Remaining current-head hosted checks and upstream approval are separate gates; no merge or release.

[Raghav-Bansal-15]

Hi kshivang - could you please approve and run the pending Build workflow on exact head 303eddb? The runs are stuck waiting for approval (for example run 34983223506), and neither contributor account has admin rights to approve them. I checked the head locally: the build passes and all 262 tests are green against the pinned BossConsole host contract. Thank you.