feat(runtime-host): negotiate managed execution profiles

[zhiiw]

Outcome

Desktop now freezes the exact managed execution profile from the resident Runtime Host before Session creation and before any managed T1. A renderer cannot mint a profile, and an unavailable v2 capability never falls back after T1.

Primary invariant

The Runtime Host owns the exact available profile set; Desktop selects the highest supported profile before durable Session creation; the persisted profile is immutable for later runs and continuations.

Ownership and atomic boundary

• Capability owner: production Runtime Host composition derives profiles only from verified Gitoxide and managed Node-test capabilities.
• Selection owner: Desktop main queries the resident Host; renderer input cannot grant an internal profile.
• Durable boundary: Session creation persists the selected profile. Query/selection failure creates no Session and is safely retryable.
• Failure state: unknown, duplicate, or non-canonical profile sets fail protocol decoding; an empty set fails closed instead of selecting attached execution.

Platform contract

• Linux: managed-coding-v1 and sandbox-proven managed-coding-v2.
• macOS: managed-coding-v1 and sandbox-proven managed-coding-v2.
• Windows: managed-coding-v1; v2 remains unavailable until a Windows managed Node sandbox is proven.

Verification

• Runtime Host and Desktop main TypeScript builds pass.
• Focused protocol, Host-kernel, dispatcher, Desktop selection, and Desktop IPC tests: 17/17 pass.
• The packaged v2 crash gate now asserts the exact platform profile set.
• A broad Windows Host-kernel run exposed four pre-existing Candidate/launcher timing failures (unavailable/EPIPE); the profile-query focused test passes and this PR does not modify those lifecycle seams.

中文说明

结果

Desktop 现在会在创建 Session 和任何 managed T1 之前，向当前 resident Runtime Host 查询真实能力，并冻结最高可用的 managed execution profile。renderer 不能自行授予 profile，T1 后也不允许因为 v2 不可用而静默降级。

主要不变量

Runtime Host 是可用 profile 集合的 owner；Desktop 在持久化 Session 前选择最高可用 profile；后续 Run 和 continuation 必须沿用该 durable profile。

• Host composition 只能从已验证的 Gitoxide 与 managed Node-test capability 推导能力。
• 查询失败、集合为空或协议内容非法时不会创建 Session，可以安全重试。
• Linux/macOS 可发布 v1+v2；Windows 当前只发布 v1，Write/Edit 不受影响，但 Node test 不会伪装成可用。
• 定向构建与测试均通过；文档同步记录了 owner、原子边界、失败状态、收敛方式和平台矩阵。