Gate managed workspace reads behind owner-bound Runtime Host execution

[zhiiw]

Summary

This change routes managed-workspace reads through an owner-bound execution capability instead of publishing a reusable working-directory string.

• Adds a revocable, owner-token-bound bridge from an opaque managed execution scope to the existing sandboxed filesystem worker.
• Limits the managed profile to Read, Glob, and Grep; mutation and unknown operations fail before worker dispatch.
• Adds explicit attached-checkout and managed-worktree Runtime Host profiles. A failed managed request never falls back to attached semantics.
• Makes Runtime Host drain active workspace operations before closing the managed workspace owner; the kernel remains responsible for closing the root owner afterward.
• Documents worker failure, timeout, abort, and host-crash behavior without claiming cross-platform parent-death cleanup.

Invariant and ownership

Primary invariant: every managed-workspace filesystem read dispatched by Runtime Host must be authorized by a currently active scope issued by the same ManagedWorkspaceOwner, and must execute through the existing read-only sandbox worker without exposing the managed cwd to public callers.

• Owner: ManagedWorkspaceOwner owns handles, active scopes, bridge dispatch, and scope revocation. Runtime Host owns composition-level admission and drain.
• Atomicity boundary: admission revalidates the exact Git artifact and immutable SQLite workspace head while owner/root residency is held, then issues a process-local scope. No new durable admission transaction or schema is introduced.
• Failure states: foreign/expired scope, missing worker, invalid profile, draining host, and mutating operation are typed fail-closed outcomes.
• Rollback: stop supplying the managed Git runtime / remove the managed profile route. Existing accepted baseline facts and artifacts remain valid because this PR adds no schema or durable protocol.

Platform boundary

• macOS: managed reads use the existing Seatbelt filesystem worker.
• Linux: requires an available sandbox backend; otherwise composition fails closed.
• Windows: lifecycle and typed profiles are supported, but managed I/O remains unavailable while the built-in filesystem worker is unavailable.
• Power-loss durability and universal parent-death process cleanup are not claimed.

Non-goals

• Desktop or CLI default enablement
• bundled Git distribution and launcher wiring
• ignored dependency, secret, or scratch provisioning
• Write/Edit/Format/Bash, mutation candidates, or workspace-version acceptance
• durable ShellRun reattachment

Validation

• npm --workspace @maka/core run build
• npm --workspace @maka/storage run build
• npm --workspace @maka/runtime run build
• npm --workspace @maka/runtime-host run build
• owner-bound scope/bridge tests: 3 passed
• worker failure → scope revocation/owner convergence regression: passed
• Runtime Host workspace/execution composition tests: 10 passed

中文说明

概要

本 PR 将 managed workspace 的只读文件操作接入 owner-bound execution capability，而不是向 host 暴露可长期保存的 cwd 字符串。

• opaque scope 只能由签发它的 ManagedWorkspaceOwner 解析，并在 callback 退出后立即失效；
• storage 内部 bridge 注入真实 cwd 和只读 sandbox boundary，只允许 Read、Glob、Grep；
• Write/Edit/Format/Bash 与未知操作在 dispatch worker 前 fail closed；
• attached checkout 与 managed worktree 使用不可混淆的 typed profile，managed 不可用时不会静默降级到 attached；
• Runtime Host 先停止新 admission、等待现有工具操作，再关闭 managed owner，最后由 kernel 关闭 root owner。

主要不变量

Runtime Host 发出的每一次 managed workspace 文件读取，都必须处于同一个 ManagedWorkspaceOwner 签发的 active scope 内，并通过现有 sandbox filesystem worker 执行；公共调用方不能取得 managed cwd，也不能借这条路径执行 mutation。

原子边界与回滚

admission 在 owner/root residency 内重新验证 exact Git artifact 与 immutable SQLite workspace head，然后签发纯进程内 scope。本 PR 不新增 schema 或 durable admission row。回滚时停止传入 managed Git runtime 或移除 managed profile 路由即可，不影响已经接受的 baseline facts/artifacts。

暂不包含

• Desktop/CLI 默认开启；
• bundled Git 打包与 launcher 接线；
• dependency/secret/scratch provisioning；
• Write/Edit/Bash、mutation candidate 与 workspace version 接受；
• durable ShellRun reattach。