feat(runtime-host): add hermetic accepted-tree Node command kernel

[zhiiw]

Summary

Adds the first bounded M5 foreground-command kernel without exposing general Bash or changing the current Desktop profile negotiation.

• introduces managed-coding-v3 and an exact managed_observation_v3 T1 identity
• freezes the accepted Git head, explicit JS entrypoint identity, exact argv, toolchain identity, and execution profile before dispatch
• executes one short-lived Node root process with no PATH, no child-process authority, read-only accepted input, disposable scratch, and an enforcing network: restricted sandbox request
• treats the exit code and bounded stdout/stderr as an observation, with Runtime-owned T2 publication and response-loss adoption
• keeps v3 unavailable in the production Host until the next composition PR provides release authority, capability negotiation, and a production-shaped crash gate

Primary invariant

Only the admission owner can turn one explicit accepted-tree Node entrypoint into a durable observation. The model cannot select an executable, cwd, environment, Node flags, dependency root, package script, sandbox policy, or output budget.

Owner: managed Node command admission owner.

Atomic boundary: accepted head + entry bytes/hash + exact argv + toolchain/profile are frozen in T1; the bounded Runtime result is committed in T2 before live publication.

Failure state: pre-T1 failures refuse dispatch; post-T1 failures remain replay-safe because the process cannot mutate accepted content or external state.

Rollback: dispose the owner-issued input/scratch lease. No accepted workspace successor is produced.

Verification

• Core, Runtime, Runtime Host, and Desktop builds
• 95 focused durable-boundary/core/Host tests
• real Node child verifies input-write and child-process denial, empty PATH, scratch-only writes, and bounded output
• admission tests reject path/argv aliases and bind exact accepted entry identity
• feat(runtime-host): retire obsolete mutation candidates #80 Linux/macOS/Windows CI is green

中文说明

摘要

这是 M5 前台命令循环的第一个受限 kernel，不开放普通 Bash，也不改变当前 Desktop 的 profile 协商。

• 新增 managed-coding-v3 与精确的 managed_observation_v3 T1 身份；
• 在 dispatch 前冻结 accepted Git head、显式 JS 入口 identity、exact argv、toolchain identity 和 execution profile；
• 只启动一个短生命周期 Node root process：无 PATH、无 child process、accepted input 只读、写入只到 disposable scratch，并强制请求 network: restricted sandbox；
• exit code 与有界 stdout/stderr 作为 observation，由 Runtime 在 T2 提交后发布；
• 当前生产 Host 仍不宣告 v3。下一张 composition PR 必须同时补 release authority、capability negotiation 和真实 Host crash gate。

主要不变量

只有 admission owner 能把 accepted tree 中的一个显式 Node 入口变成 durable observation。模型不能选择 executable、cwd、environment、Node flags、dependency root、package script、sandbox policy 或输出上限。

Owner：managed Node command admission owner。

原子边界：accepted head、entry bytes/hash、exact argv、toolchain/profile 在 T1 冻结；Runtime-owned 有界结果在 live publication 前提交 T2。

失败状态：T1 前失败拒绝 dispatch；T1 后失败仍可安全 replay，因为进程无权修改 accepted content 或外部状态。

回滚：释放 owner-issued input/scratch lease，不产生 accepted workspace successor。