[Security] Reapprove changed plugin artifacts and minimize MCP child environments

[fettpl]

Summary

• Binds every plugin connector approval to the exact canonical artifact digest, immutable executable snapshot, launch configuration, and discovered tool inventory.
• Starts stdio MCP children from the pinned packaged runtime with a minimal platform environment while transferring explicitly declared connector data over an owned startup pipe.
• Fails closed when reviewed identity drifts, legacy approval records are encountered, bootstrap data is malformed or oversized, or connector/process lifecycle races occur.

Root cause and design

Approval identity previously stopped at the plugin/version/binding boundary, so same-version artifact or launch changes could retain authority. Stdio MCP children also inherited the desktop process environment. The new design computes a bounded canonical SHA-256 artifact identity, snapshots the reviewed executable, binds the discovered inventory, and revalidates the exact identity across reconciliation and invocation transitions. Child launch uses only required platform values plus connector-owned startup data. Bootstrap acknowledgement is raw-byte bounded at 64 KiB, has an injectable timeout, and every terminal bootstrap failure closes the complete owned process tree.

Dependency

This PR is stacked on #250 ([Security] Enforce least-privilege connector permissions and action approval) at 8607bcd48ff879b6e6ee503af917bb3d037ffbdf and should merge after it.

Acceptance outcomes

• Artifact, executable, launch configuration, or tool-inventory drift revokes the grant and disables the connector.
• Legacy approval origins fail closed; no authority is migrated forward.
• Ambient parent environment values are excluded from MCP child environments.
• Invalid, oversized, silent, or failed bootstrap acknowledgement closes the owned child and descendants.
• Process ownership, teardown, Windows helper containment, packaged runtime staging, signatures, and startup identity are verified.
• Connector management continues through the dependency's private Electron IPC boundary.

Validation

• Exact reviewed head: 4929d315c1fd7e13830cb3213e96644d744d8e3a.
• Focused MCP bootstrap suite: 10/10 passed; five-run stress repeat: 50/50 passed.
• npm --prefix services/agent-runtime run check: 99/99 tests passed, helper verification passed, and TypeScript passed.
• Independent invalid-ack process-tree fixture confirmed the parent, descendant, and POSIX process group all terminate.
• npm run check: passed the full repository gate.
• Guarded push pre-push npm --prefix frontend run check:quality: passed, including production build.
• git diff --check 8607bcd48ff879b6e6ee503af917bb3d037ffbdf 4929d315c1fd7e13830cb3213e96644d744d8e3a: passed.
• Production desktop:dist, packaged runtime probes, and deep strict code-signature verification passed at the exact reviewed head.
• Canonical /Applications/Local Studio.app reinstall completed; GET /api/desktop-health returned HTTP 200.
• Independent P0/P1 review found no remaining blocker at the exact head.
• Exact-head CI and Security runs are action_required with zero jobs; an upstream maintainer must approve the fork workflows before GitHub can execute them.
• The root package does not define a separate test:integration script; the available full repository and runtime suites above were run.

Closes #233

[fettpl]

@0xSero Exact head 4929d315c1fd7e13830cb3213e96644d744d8e3a is independently P0/P1-approved. Focused bootstrap tests passed 10/10 plus 50/50 stress; agent-runtime passed 99/99; full repository and pre-push gates passed; production packaging, canonical reinstall, and desktop health 200 passed. Exact-head CI and Security are awaiting fork-workflow approval (action_required, zero jobs). Please approve the workflows and review when ready.