feat(runtime-host): admit exact accepted-world Node tests

[zhiiw]

Summary

Admit one explicit dependency-free Node test observation from the exact accepted Gitoxide world and an owner-issued hermetic toolchain capability.

Primary invariant

Before T1, the Runtime Host must bind one exact accepted repository/workspace/epoch/version/commit/tree, the canonical test-file identities, a verified Node toolchain identity, and a fixed hermetic execution profile. After admission, the operation and disposable roots are linear and cannot silently fall back to PATH, npm, package scripts, or the attached checkout.

Authority and atomic boundary

• Gitoxide managed session owns accepted-head observation and exact-tree materialization.
• Managed command sandbox owns toolchain identity, file observations, sandbox/process lifecycle, and structured test output.
• A storage-root execution owner holds the write lease for the full disposable-root lifetime; admission receives no raw storage path or recursive-delete authority.
• Runtime remains the only T1/T2 and immutable provider-result owner.
• This slice adds no SQLite table or second writer.

Failure and convergence

• Boundary, materialization, toolchain, or file-identity failure rejects before T1 and releases the disposable roots.
• Post-T1 input drift fails closed under the existing managed-observation recovery contract.
• T1/T2 publication remains owned by immutable RuntimeEvents and the existing tool ledger.
• No fallback to ordinary test execution is permitted.

Scope

This intentionally does not add the tool to managed-coding-v1. A later versioned product profile must land with packaged/current-process toolchain proof, enforcing sandbox evidence, and production-shaped Host/helper crash recovery.

Validation

• Runtime durable boundary: 45/45
• Host admission + sandbox owner: 5/5
• Runtime Host typecheck and build: pass
• Gitoxide exact materialization is added to the existing real-helper session suite; this Windows checkout cannot locally rebuild the Rust helper because MSVC link.exe is unavailable, so the repository helper CI remains the real-binary evidence owner.

中文说明

本 PR 建立 M5 的 Runtime Host admission：ManagedNodeTest 在 T1 前必须绑定 exact accepted Gitoxide head、workspace epoch/version、显式测试文件 bytes/SHA-256、受权 Node toolchain identity 与固定 hermetic profile。

权限边界已经收窄：Gitoxide session 只拥有 accepted-tree；command sandbox 只拥有 toolchain/process；execution-root owner 持有完整生命周期的 storage-root write lease；admission 不接收裸 storage path，也没有任意递归删除权限；Runtime 仍是唯一 T1/T2 与 provider result owner。

任何 identity、物化或 toolchain 失败都在 T1 前拒绝并清理。T1 后禁止回退到 PATH、npm、package script、attached checkout 或普通 test runner。

本 PR 不会静默扩大现有 managed-coding-v1。后续必须通过版本化产品 profile，在 enforcing sandbox 和真实 Host/helper kill-reopen 证据齐备以后再接 Desktop。