Consume immutable dependency snapshots in managed Node tests

[zhiiw]

Summary

This stacked delivery makes an optional pre-provisioned npm dependency tree an actual read-only input of ManagedNodeTest.

The primary invariant is:

Before T1, a managed Node test selects either no dependencies or one owner-issued immutable snapshot. T1 binds the exact environment/content/runtime identity, and execution can read only the accepted Git tree plus that leased snapshot. It never falls back to the attached checkout, PATH, npm, the network, or dependency installation.

Authority and atomic boundary

• ManagedDependencySnapshotAuthority owns immutable publication, receipts, and leases.
• The dependency admission owner combines package metadata from the accepted Git tree with existing node_modules bytes from the attached source.
• The command owner alone holds the lease-consumer token. It resolves the private path, verifies runtime/toolchain compatibility, and grants read-only sandbox access.
• RuntimeEvents contain only stable identity; paths and filesystem capabilities remain process-private.

The boundary is:

accepted metadata + imported dependency bytes -> durable snapshot receipt -> opaque lease -> managed_observation_v2 T1 -> enforcing sandbox -> exact durable observation -> lease release

A forged, wrong-owner, released, drifted, oversized, or runtime-mismatched snapshot fails before helper spawn. Missing node_modules is explicitly recorded as dependency.kind = none; no install is attempted.

Verification

• Core, Runtime, Storage, and Runtime Host builds pass.
• Focused authority/admission/sandbox/release tests: 24 passed, 0 failed, 0 skipped.
• The real Electron helper imports an ESM package only from the leased snapshot and rejects a released lease.
• Snapshot process-exit convergence remains covered at both receipt and publication failpoints.
• The packaged Host crash gate now includes an ignored dependency tree and verifies that a completed Node test is not replayed after Host death.

This remains Draft while its stacked prerequisites are reviewed and the three-platform packaged crash gate runs in CI.

中文说明

摘要

这个堆叠 PR 把预先存在的 npm node_modules 导入成不可变依赖快照，并让 ManagedNodeTest 真正以只读方式消费它。

主要不变量是：

在 T1 前，测试只能选择“无依赖”或一个 owner 签发的不可变快照。T1 绑定精确的 environment、content tree 与 runtime identity；执行时只能读取 accepted Git tree 和该快照，禁止回退 attached checkout、PATH、npm、网络或临时安装。

权限边界：

• Storage authority 唯一拥有快照发布、receipt 和 lease；
• admission 使用 accepted tree 中的 package.json / package-lock.json，source 只提供现有 node_modules 字节；
• command owner 独占 consumer token，只有它能解析私有路径、验证 runtime/toolchain 并授予 sandbox 只读权限；
• RuntimeEvent 只保存稳定身份，不保存路径或文件系统 capability。

伪造、错 owner、已释放、漂移、超限或 runtime 不匹配的快照都会在 helper 启动前失败。没有 node_modules 时明确写入 dependency.kind = none，不会尝试安装。

验证结果：四个 workspace 构建通过；定向测试 24/24；真实 Electron helper 只能从 lease 导入 ESM 包；两处 snapshot crash failpoint 继续通过；packaged Host crash gate 已加入 ignored dependency tree，并验证 Host 死亡后不会重放已完成测试。

当前保持 Draft，等待堆栈前置审查与三平台 packaged crash gate。