feat(git): bind helper artifacts to opaque capabilities

[zhiiw]

Summary

This stacked Draft establishes one narrow invariant above the short-lived Gitoxide helper in apache#3561:

A caller cannot self-authorize a helper with a raw executable path or SHA-256. Only an internally issued, owner-bound release artifact claim can become an opaque invocation capability after exact platform, architecture, protocol, size, path, and digest verification.

The artifact is reverified before the capability is resolved for its designated invocation owner. Symlink/junction traversal, forged claims, wrong-owner use, and post-admission byte changes fail closed.

Boundary

• Owner: Runtime Host internal artifact authority.
• Atomic boundary: one regular-file handle observation with bounded streaming SHA-256 plus before/after file identity checks.
• Failure states: invalid/unsupported release claim, invalid artifact, identity mismatch, invalid invocation capability.
• Rollback: none; this slice is read-only and has no durable state.

This is deliberately still a Draft. It does not establish a platform signing trust root, protected installation root, helper spawn identity, repository observation admission, or a Desktop/CLI consumer. The internal release-claim issuer is only the seam for a future packaged-release owner; an adjacent manifest or caller-provided digest is not treated as authority.

Verification

• Runtime Host TypeScript build
• Artifact authority tests: 4 passed
• Gitoxide helper protocol tests: 4 passed
• Biome check and git diff --check

Stacked base: codex/gitoxide-short-lived-helper / apache#3561.

中文说明

这个 stacked Draft 只证明一个边界：普通调用方不能通过自报 helper 路径或 SHA-256 获得执行资格。只有内部 release owner 签发、与 owner token 绑定的 artifact claim，在平台、架构、协议、大小、路径和 digest 全部严格校验后，才能变成指定 invocation owner 可消费的 opaque capability。

每次解析 capability 前都会重新校验制品；伪造 claim、错误 owner、symlink/junction 路径和 admission 后字节变化都会 fail closed。

当前仍没有正式的平台签名信任根、受保护安装目录、helper spawn、repository admission 或 Desktop/CLI 消费者，所以必须保持 Draft。内部 issuer 只是未来 packaged-release owner 的接缝，不能把相邻 manifest 或调用者提供的 digest 当成信任根。

验证结果：Runtime Host 编译通过；artifact authority 4/4；前置 Gitoxide helper 协议 4/4；Biome 与 diff check 通过。

[zhiiw]

Superseded by apache#3561. Its implementation and tests were rebuilt from the latest upstream main and included there as part of the consolidated Gitoxide repository admission/import invariant. This extraction PR remains available as design and review history.

中文说明

本 PR 已由 apache#3561 取代。对应实现和测试已从最新 upstream main 重建，并作为完整的 Gitoxide repository admission/import 不变量合入该 Draft。这里继续保留为设计和评审历史。