feat(cli): reconcile exact local Runtime Host restarts

[me2seeks]

Summary

• extract the immutable Runtime Host package store from managed-service composition so managed services and local-process handoffs share one integrity-keyed implementation;
• resolve the persistent npm-global installation owner, re-resolve the exact installed release from registry evidence, and stage the verified runnable closure before any owner mutation;
• add first-owner bootstrap without inventing a legacy deployment identity, while existing owners continue through the single durable handoff transaction;
• let an interactive TUI user explicitly Restart an incompatible local ephemeral Host through exact-Host legacy takeover, then verify the staged PID/generation/Ready evidence before committing ownership;
• keep transient npx, remote Hosts, service Hosts, unknown lifecycle modes, and active/durable work outside this mutation path.

The restart path is deliberately bounded. Compatible release skew still connects without forcing replacement. A released Host that reports active or durable work is not interrupted by the legacy adapter; the TUI returns to truthful wait/cancel guidance. Explicit npm package switching and a newer active-work retirement adapter remain follow-up work in #3243/#3245.

Architecture

This adds no deployment journal, scheduler, or second authority lock. Initial claim and existing-owner handoff both hold the account-local deployment authority; the State Root writer remains the cutover fence. Registry integrity is artifact identity, while the transaction-derived generation is only a launch/retry fence. A normally connecting CLI fails closed if a staged Host is Ready but its durable CLI ownership was not committed.

Refs #3231
Refs #3243
Refs #3245
Refs #3709

简体中文

本 PR 交付 #3243 的下一条本地主线：把 managed-service 已有的 integrity-keyed package store 抽成共享实现；npm-global CLI 根据稳定 installation owner 与 registry SHA-512 证据，在任何 authority mutation 前固化精确可运行 closure；无 owner record 时先完成 exact takeover/Ready 再建立 initial claim，已有 owner 时继续走唯一 durable handoff。

TUI 只在用户明确选择 Restart 后调用该流程。npx、remote、service、未知 lifecycle 与仍有 active/durable work 的旧 Host 都不会被这条 legacy adapter 强制替换。compatible release skew 也不会仅因版本字符串不同而自动重启。显式 npm package switch、active-work retirement capability 和完整中文交互仍由 #3243/#3245 后续切片承担。

没有新增 deployment journal、scheduler 或第二把 authority lock；transaction generation 只是 launch/retry fence，不冒充 artifact identity。若 staged Host 已 Ready 但 durable CLI owner 未提交，普通连接会 fail closed，而不是静默继续。

Verification

• built @maka/core, @maka/storage, @maka/mcp, @maka/runtime, @maka/runtime-host, @maka/eval, and maka-agent from the exact rebased head;
• Runtime Host and CLI typechecks passed;
• focused CLI installation, registry package, local restart, context, managed setup, and service-manager suites passed: 53/53;
• focused durable owner, initial claim, and local handoff suites passed: 33/33;
• scoped Biome and git diff --check passed.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex assisted with source-first architecture analysis, implementation, tests, simplification review, first-principles review, and PR drafting. The human contributor will review the PR before merge.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck, and affected suites pass locally

Does this PR entail a change in behavior?

• Yes — an installed npm-global TUI can explicitly restart an idle incompatible local ephemeral Runtime Host from an exact verified staged release.
• No

[Astro-Han]

I reviewed this head and found no blocking issues.

Implements exact local Runtime Host restarts via staged handoff with generation/pid identity checks, ephemeral-only guard, and idempotent replay; hosted test+windows_recovery SUCCESS.

No P0-P3.

简体中文

该头无阻断。

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[Astro-Han]

APPROVE — f6ab656, no P0-P3, hosted checks SUCCESS, per me2seeks pre-auth for this batch.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.