feat(runtime-host): add crash-safe managed workspace inspection

[zhiiw]

Summary

Adds the first dedicated production consumer for the managed dependency execution profile: the read-only ManagedWorkspaceInspect task. Runtime Host owns packaged Git/npm admission, workspace admission, dependency provisioning, worker routing, cancellation, drain, and exact replay through one explicit composition.

Primary invariant

A replay-safe managed inspection is admitted once against one canonical workspace baseline and one attested dependency artifact. A Host crash after durable receipt publication must converge on reopen without duplicating baseline, artifact, or receipt state.

• Owner: Runtime Host production execution composition
• Atomicity boundary: durable managed admission + dependency receipt; the provider-facing result is emitted only after the read-only operation completes
• Failure state: cancellation, source drift, invalid profile, unavailable authority, or packaged-resource delegation mismatch fails closed; there is no attached-checkout fallback
• Rollback: remove the dedicated tool registration and composition consumer; lower capabilities remain dormant

Packaged resource trust boundary

The fd3/PID/path bootstrap is direct-parent application delegation, not a platform signature or cryptographic identity proof. The provenance trust root is the outer signed application and release/update chain. Public CLI input and ambient paths cannot claim bundled resources, but a malicious same-user process able to launch arbitrary Electron parents, manufacture inherited descriptors, and replace application resources is outside the v1 threat model. Covering that attacker requires a future platform-signature verification owner, not more PID/path fields.

Verification

• Runtime Host and Storage builds passed.
• Plan Mode excludes ManagedWorkspaceInspect.
• Real development Electron cannot use the public issuer to claim bundled resources.
• Source drift, dependency Glob routing, singleflight replacement, and baseline/scope cancellation tests passed.
• The production composition runs actual bundled npm, installs pinned semver@7.7.3, verifies the generated platform .bin entry, and reads the leased dependency rather than attached node_modules.
• A production-shaped child-process test kills the Host after the dependency receipt becomes durable, reopens the same task, and verifies one canonical baseline, artifact, receipt, and replay result.

Stack

1. durable dependency artifact authority
2. constrained npm producer
3. bundled npm runtime attestation
4. owner-bound and cancellable managed admission authority
5. This PR: production managed inspection task + crash/replay proof

中文说明

本切片加入第一个生产消费者 ManagedWorkspaceInspect，把 packaged Git/npm、workspace admission、dependency provisioning、只读 worker 路由、取消、drain 与 crash replay 接成一条明确链路。

fd3/PID/path 只负责直接父子进程之间的应用委托，不是平台签名或密码学身份验证。真正的来源信任根是外层已签名应用与发布/更新链；能够启动任意 Electron 父进程并同时替换应用资源的同用户恶意进程不在 v1 威胁模型内。

验收使用真实 bundled npm 安装固定依赖并验证 .bin，同时在 dependency receipt durable 后杀死 Host，重开后证明 baseline、artifact、receipt 与只读结果均唯一收敛。

[zhiiw]

Closed as an obsolete extraction/integration slice. The current delivery path is the merged Gitoxide foundation followed by #40 -> #41 -> #42. This PR remains available as design and implementation history.

中文说明

该 PR 属于旧 extraction/integration 栈，现已失去独立合并价值。当前交付路径是已合并的 Gitoxide 基础，然后依次审查 #40 → #41 → #42。这里继续保留设计、实现与审查历史。