feat(runtime-host): add hermetic Node test observation

[zhiiw]

Summary

Adds the first bounded M5 test observation on top of the hermetic command sandbox.

Primary invariant

An explicit set of accepted-world Node test files can be observed only inside one owner-controlled, enforcing sandbox profile. The caller cannot supply a package script, executable, argv, environment, cwd, network policy, or child-process permission.

Owner and atomic boundary

• The toolchain authority owns the exact Node/helper artifact identity.
• The command sandbox owner owns roots, profile, environment, budgets, spawn, and process-tree lifecycle.
• The short-lived helper owns one canonical file set and executes node:test with isolation: none.
• The atomic boundary is one helper lifetime. This PR does not persist T1/T2 and does not claim Resume yet.

Failure and rollback

• Pre-spawn validation/sandbox unavailability: clean failure, no test execution.
• Timeout, abort, overflow, protocol corruption, or nonzero helper exit: fail closed.
• Assertion failures are a valid structured observation (failed > 0).
• Accepted input is read-only; scratch is disposable; helper exit destroys the in-process test world.

Scope limits

This does not install dependencies, discover npm through PATH, consume source-checkout node_modules, expose Bash, or grant network/external effects. Projects requiring a dependency capability remain explicitly unavailable until M5.3.

Verification

• Runtime Host TypeScript build
• 4 focused real-process tests
• Electron Node 24 helper executes pass/skip/fail cases
• test stdout cannot corrupt the response protocol
• child process creation and accepted-input writes are denied
• empty test collections fail closed

This remains Draft until the three OS sandbox backends have production smoke coverage and the durable test settlement slice freezes its boundary before T1.

中文说明

摘要

在 hermetic command sandbox 之上增加第一条有界的 M5 Node 测试 observation。

主要不变量

只有 owner 控制的 enforcing sandbox 才能执行 accepted world 中显式列出的 Node 测试文件。调用者不能传 package script、可执行文件、argv、environment、cwd、网络策略或 child-process 权限。

Owner 与原子边界

• toolchain authority 拥有精确 Node/helper artifact identity；
• command sandbox owner 拥有 roots、profile、environment、预算、spawn 与 process-tree lifecycle；
• 短生命周期 helper 拥有一次 canonical 文件集合，并固定使用 node:test 的 isolation: none；
• 原子边界是单次 helper 生命周期。本 PR 尚不写 T1/T2，也不声称已经支持 Resume。

失败与回滚

• spawn 前校验或 sandbox 不可用：干净失败，不执行测试；
• timeout、abort、overflow、协议损坏或 helper 非零退出：fail closed；
• assertion failure 是可信结构化 observation（failed > 0）；
• accepted input 只读，scratch 可丢弃，helper 退出后 in-process test world 被销毁。

范围限制

本 PR 不安装依赖、不从 PATH 发现 npm、不借用 source checkout 的 node_modules、不暴露 Bash，也不授予网络/外部副作用。需要依赖 capability 的项目在 M5.3 完成前明确 unavailable。

当前保持 Draft，直到三平台 OS sandbox smoke 与 durable test settlement 闭环。