docs: supersede RFC 2447 with SDK-owned runtime RFC

[f-trycua]

Summary

• add RFC 2549, making the typed SDK-owned runtime the default application boundary
• make authorization portable as a runtime ceiling plus immutable session contexts
• preserve released behavior through a compatibility session for existing CLI, MCP, daemon, Rust, Python, and TypeScript callers
• require trusted host creation and authenticated action binding before advertising mixed permission modes in one runtime
• retain separate runtime-owner processes as the safe fallback and private workers and authenticated services as explicit optional topologies
• start with one direct runtime per process
• preserve the standalone macOS CuaDriver.app identity while allowing direct ownership for embedded hosts
• keep gRPC, MCP, HTTP, local sockets, and environment forwarding outside the transport-free native runtime and public SDK contract
• coordinate generated remote Driver connections with docs: propose Cua Driver environment convergence RFC #2513 without creating a second desktop-control vocabulary
• mark RFC 2447 as superseded while carrying forward its typed SDK, generated binding, native core, and versioned C ABI decisions
• add a diagram-driven north-star note for the target topology and migration path

Why

RFC 2447 combined the typed SDK contract, ABI direction, runtime ownership, MCP topology, permission-mode isolation, and platform lifecycle into one broad proposal. RFC 2549 keeps the contract decisions that have proven useful and replaces the less focused runtime and process-topology guidance with explicit ownership, lifecycle, platform, authentication, migration, and acceptance gates.

The permission contract is deliberately separated from the process topology. Effective authority is the intersection of an immutable runtime ceiling, an immutable session context, managed policy, and user policy. A model-visible tool argument, public session ID, MCP metadata field, or reconnect token is never authority.

Discussion: #2549
Supersedes: #2447
Related remote-connection proposal: #2513
Canonical authorization prerequisite: #2542
Portable session-authorization foundation: #2545

Compatibility promise

This refactor is not allowed to disrupt current CLI, MCP, Rust, Python, or TypeScript users. Existing commands, defaults, flags, sockets, platform identity, exit codes, schemas, constructors, typed methods, package exports, result envelopes, structured errors, and lifecycle behavior are explicit release gates.

Released callers that do not use a future trusted host session API inherit a compatibility session with today's behavior and require no source changes. The host-only session factory is additive. Mixed modes are exposed only on topologies whose session-to-action binding passes substitution, replay, expiry, revocation, generation, and reconnect tests.

Browser-use improvements may continue shipping through the current CLI and daemon topology. Canonical dispatch authorization (#2542) and the portable session-authorization foundation (#2545) can land before the larger SDK-owned-runtime refactor; direct SDK ownership, private workers, remote connections, and service cleanup do not block the browser release.

Security and disclosure review

The public issue, RFC, north-star note, and staged diff were scanned for credentials, private paths, private user or partner context, sensitive screenshots, raw session material, and vulnerability details. The proposal states target security requirements without publishing implementation-state vulnerability claims.

Validation

• npm --prefix docs run docs:check-hygiene
• npm --prefix docs run docs:check-links
• npm --prefix docs run docs:check
• Markdown whitespace checks for the new and modified RFC files
• staged-file sensitive-content scan
• independent Claude Code Fable architecture review, followed by a blocker-closure review with a ready verdict