feat(cli): reconcile exact local Runtime Host restarts - #3920

Summary

• extract the immutable Runtime Host package store from managed-service composition so managed services and local-process handoffs share one integrity-keyed implementation;
• resolve the persistent npm-global installation owner, re-resolve the exact installed release from registry evidence, and stage the verified runnable closure before any owner mutation;
• add first-owner bootstrap without inventing a legacy deployment identity, while existing owners continue through the single durable handoff transaction;
• let an interactive TUI user explicitly Restart an incompatible local ephemeral Host through exact-Host legacy takeover, then verify the staged PID/generation/Ready evidence before committing ownership;
• keep transient npx, remote Hosts, service Hosts, unknown lifecycle modes, and active/durable work outside this mutation path.

The restart path is deliberately bounded. Compatible release skew still connects without forcing replacement. A released Host that reports active or durable work is not interrupted by the legacy adapter; the TUI returns to truthful wait/cancel guidance. Explicit npm package switching and a newer active-work retirement adapter remain follow-up work in #3243/#3245.

Architecture

This adds no deployment journal, scheduler, or second authority lock. Initial claim and existing-owner handoff both hold the account-local deployment authority; the State Root writer remains the cutover fence. Registry integrity is artifact identity, while the transaction-derived generation is only a launch/retry fence. A normally connecting CLI fails closed if a staged Host is Ready but its durable CLI ownership was not committed.

Refs #3231
Refs #3243
Refs #3245
Refs #3709

Verification

• built @maka/core, @maka/storage, @maka/mcp, @maka/runtime, @maka/runtime-host, @maka/eval, and maka-agent from the exact rebased head;
• Runtime Host and CLI typechecks passed;
• focused CLI installation, registry package, local restart, context, managed setup, and service-manager suites passed: 53/53;
• focused durable owner, initial claim, and local handoff suites passed: 33/33;
• scoped Biome and git diff --check passed.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex assisted with source-first architecture analysis, implementation, tests, simplification review, first-principles review, and PR drafting. The human contributor will review the PR before merge.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck, and affected suites pass locally

Does this PR entail a change in behavior?

• Yes — an installed npm-global TUI can explicitly restart an idle incompatible local ephemeral Runtime Host from an exact verified staged release.
• No