build(orcad): prepare the SSH convergence rebuild on current main

[nwparker]

	Files	Added	Deleted	Net
Test	3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​60	$\color{#cf222e}{\Huge{\mathbf{−}}}$​3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​57
Prod	2	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​6	$\color{#cf222e}{\Huge{\mathbf{−}}}$​3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​3

ELI5

Main now has Bun-backed Orca and SQLite profile storage. The old convergence PR cannot safely replace those implementations. This draft starts the rebuild from main at 46907de6022, retaining its Bun 1.4.2 and storage behavior.

Preparation only. Not a merge-ready replacement for #16741.

What Changed

• Desktop and release builds generate the existing deployment template after other app outputs.
• macOS, Linux, and Windows desktop packages include that template as a real resource directory.
• Packaging refuses a missing or corrupt template using main's existing verifier.
• Tests cover resource inclusion, build ordering, and packaging refusal.

There is no new user-facing SSH workflow yet. Managed deployment targets remain POSIX-only; packaging a template in a Windows desktop does not add managed Windows-host support.

Why

A trial replay of #16741 produced 109 conflicts. More importantly, restoring its old startup and persistence code would discard main's SQLite authority and final-flush protections, while its older Bun code would replace newer native terminal fixes.

This preserves main's implementation and prepares its existing deployment payload for the remaining convergence work instead of reviving duplicate runtime code. Main intentionally omitted this unused payload; do not merge this draft until the deployment consumer is wired. The locally generated template is approximately 102 MB before compression.

Linked Issue

Continuation of #16741 after #22635. The old branch/head a68b6f35311012846a423654cee72866567b14cd remains untouched and preserves the full implementation.

Remaining before readiness

• SSH access to an existing paired runtime: authenticated identity verification, durable exclusive target ownership, reconnect and unlink recovery.
• Managed host provisioning using main's deployment and SQLite preflight/snapshot rules.
• Existing catalog conversion and duplicate-registration reconciliation adapted to current persistence.
• Decide whether live workload ownership transfer remains in this replacement or is a separate follow-up. It is not ported or enabled here.
• Full consumer journeys, mixed-version coverage, and supported real-host platform validation.

No claim of universal lossless migration or completion of SSH/Remote unification.

Visual Proof

N/A — build and packaging preparation only; no UI changes.

Testing

• Automated tests added/updated.
• pnpm install --frozen-lockfile: passed.
• pnpm tc: passed.
• Eight focused packaging, artifact-materialization, deployment, and rollback suites: 92 tests passed.
• Targeted oxlint, formatting, and diff whitespace checks: passed.
• Fresh template build on macOS arm64: six target payloads verified, Bun 1.4.2 included, 4,648 modules, no Electron or node:sqlite imports in the daemon bundle.

Tests used background-launch and mock-keychain flags. No installer was produced, no user host was upgraded, and no live migration or Windows/Linux hardware matrix was executed.

Review

Two independent audits identified runtime/storage overlap and the remaining SSH ownership requirements. Main's runtime implementation, terminal backend, deployment transactions, lockfile, and persistence implementation are unchanged in this draft.

Agent skill upstream boundary

• Not applicable; no skill installation or sharing code changes.

Checklist

• This initial preparation change is small and focused.
• Explained the before/after, mechanism, and alternatives.
• No UI changes.
• Cross-platform resource paths and SSH target limits considered.
• Deployment consumer and full convergence acceptance completed.
• Ready to merge.

[OrcaWin]

Closing as superseded: desktop builds now ship the managed server template through #24155, so this preparation branch is no longer needed.