feat(cua-driver): expose foreign remote envelope channels

[f-trycua]

Main-branch landing checkpoint

This remains the additive generated-language bridge after the receiver in #3650. The refresh to main leaves its Python, Rust SDK, TypeScript companion bindings, generator, and contract-workflow changes unchanged. It opens no listener and does not replace existing constructors or computer-server clients.

The complete follow-on integration at 43a332a66d8379b4fb9330c6a96f0654cc4afea1 passes native Windows unit/compile and generated contract/binding checks, including 237 Sandbox/native bridge regression tests. This is not a claim that a published package or Fleet image includes the bridge.

Earlier remaining-gate notes below describe prior checkpoints. Main-branch merge is being evaluated separately from release, image publication, and rollout.

Scope

Additive generated-language bridge for the accepted narrow #2512 slice. Stacked on #3650; phase contract #3647.

A host-supplied ForeignDriverEnvelopeChannel now constructs the ordinary canonical CuaDriver. Its existing generated typed methods use the existing Rust remote backend. No second Python desktop class, MCP conversion, Fleet dependency, listener, credential issuer, or auth redesign.

The bridge projects canonical envelopes into generated records (JSON strings for open-ended payloads, checked u64 deadline), snapshots opaque carrier identity, and closes rejected bound channels.

Generated outputs and cancellation

Regenerated Python and TypeScript companion bindings with the repository generator. Python comes first for environment integration; these exports do not claim TypeScript remote E2E.

Native-backed tests reproduced UniFFI 0.31 scheduling foreign-future cancellation on a Rust worker thread via non-thread-safe call_soon. A narrow, count-checked generator normalization uses call_soon_threadsafe. Generated code was not patched by hand; asyncio debug and unraisable-hook assertions stay enabled.

Validation

At implementation a989072:

• 6 Rust remote tests pass.
• 6 native-backed Python remote tests and 4 existing loader tests pass against the built release library.
• Canonical binding generator --check and TypeScript typecheck pass.
• Targeted formatting and git diff --check pass.
• Existing CI test command includes the new remote suite.

At reviewed head eef8602, full SDK tests pass: 66 unit tests and 2 runtime-configuration tests. Ten native-backed Python bridge tests and four loader tests pass without private event-loop setup; the generator --check passes. Independent review fixes capture each foreign channel's owning loop, refuse wrong-loop lowering, handle closed-loop callbacks, and close rejected/cancelled child bindings. Adjacent module declarations from the parent merge retain both modules.

Remaining gates

Stacked CI, actual Fleet carrier integration, exact-candidate guest desktop/server compatibility and cleanup remain outstanding. Independent review's two lifecycle findings are addressed and regression-tested. No live guest or cross-platform desktop proof is claimed here. No installed tooling changed. Keep draft and unmerged; no deployment or image publication is authorized.

Rollback is to keep consumers on the unchanged existing constructors and computer-server route until the full opt-in stack is qualified.

Latest verification

Final bridge head 3ddc1ee includes the reviewed callback/lifecycle fixes and the missing public ActionTarget export, with a dedicated regression test. All 15 native-backed Python remote/loader tests pass (10 remote, 5 loader). The Rust implementation remains identical to the 66 SDK unit + 2 configuration passing checkpoint. Generator check and TypeScript typecheck passed before this Python-only export/test change. All applicable final-head CI checks pass. Stacked consumers: #3653 and #3654. No merge, release, installed-tool change, or live guest qualification.

[f-trycua]

CI disposition: the fresh contract/bindings run https://github.com/trycua/cua/actions/runs/34304291219 passes, including the previously failing macOS embedded-host lifecycle test. Current head 8b4fe60 has the identical complete source tree as 9e35646 from failed run https://github.com/trycua/cua/actions/runs/34303028480; no source or assertion was weakened. The old log shows parent-pipe EOF and shutdown, followed by a PID-liveness assertion timeout. It does not establish deterministic orphaning or prove the exact cause. Residual teardown timing/reaping risk remains; this is not claimed fixed by the bridge. Existing lifecycle work in #3281 remains separate.