feat(desktop): manage Runtime Host update policy

[M4n5ter]

English

Summary

Managed Runtime Hosts can now follow a per-Host update policy: manual, an exact version, the latest stable channel, or the next preview channel. Desktop reads and changes the policy through the Host's bound SSH operator, exposes one-shot reconciliation, and reconnects after a compatible update.

Automatic policies are offered only when the Host reports a healthy update scheduler. Every Desktop policy and reconciliation request is fenced to the expected managed service target, so a stale or redirected operator cannot mutate another Host.

Local Desktop development now prepares and caches a private CLI archive on first use. MAKA_RUNTIME_HOST_SETUP_ARCHIVE remains an optional override; normal development no longer depends on a matching npm version being published.

Fixes #3768

Verification

• Desktop renderer and Storybook typechecks — passed
• Desktop, CLI, and Runtime Host affected suites — passed
• Biome lint, formatting, repository typecheck, and git diff --check — passed
• Runtime Host full suite — one unrelated shared-cache race failed; the exact test passed in isolation
• Exercised a real Desktop-to-Linux Host flow over SSH without a setup-package environment variable: lazily build and upload the companion CLI, reconnect across a compatibility upgrade, save manual/latest policies, run an immediate check, and restore the manual policy

Screenshots

Automatic update policy	Compact action menu

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed implementation, tests, analysis, and remote Desktop verification under maintainer direction and review

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

摘要

现在可以为每个受管 Runtime Host 分别选择更新策略：手动、固定版本、Latest 稳定频道或 Next 预览频道。Desktop 通过该 Host 绑定的 SSH operator 读取和修改策略，支持立即执行一次 reconciliation，并在兼容更新后重新连接。

只有 Host 报告更新调度器状态正常时才开放自动更新策略。Desktop 发出的每个策略与 reconciliation 请求都会绑定预期的受管服务目标，避免过期或被重定向的 operator 修改其他 Host。

本地 Desktop 开发现在会在首次需要时自动生成并缓存私有 CLI archive。MAKA_RUNTIME_HOST_SETUP_ARCHIVE 仍可用于显式覆盖；常规开发不再依赖 npm 已发布相同版本。

修复 #3768

验证

• Desktop renderer 与 Storybook 类型检查 — 通过
• Desktop、CLI 与 Runtime Host 受影响测试套件 — 通过
• Biome lint、格式检查、仓库类型检查与 git diff --check — 通过
• Runtime Host 完整测试套件 — 一个与本 PR 无关的共享缓存竞争失败；该测试单独重跑通过
• 已在未设置安装包环境变量的情况下，通过 SSH 对真实 Linux Host 验证完整 Desktop 流程：懒构建并上传配套 CLI、跨兼容版本升级后重连、保存手动/Latest 策略、立即检查并恢复手动策略

截图

自动更新策略	紧凑操作菜单

AI 使用

• 没有生成式工具作出实质性贡献
• 生成式工具作出了实质性贡献

工具与范围：OpenAI Codex 在维护者指导和审核下参与了实现、测试、分析和远程 Desktop 验证

检查清单

• 测试覆盖本次变更，并会在缺少该变更时失败
• lint、格式检查、类型检查和受影响测试均在本地通过

本 PR 是否会改变行为？

• 是 — 已在上方摘要中说明
• 否

[Astro-Han]

I reviewed this head and found a blocking issue.

[P2] Development build closing race allows immediate retry to join a doomed build

runtime-host-setup-package.ts:104-111 reuses shared developmentBuild even while its close is still in flight. After the last waiter aborts and closes, a new resolve() can immediately pick the same closing build and receive stopped instead of starting a fresh build.

Fix: mark closing builds as unavailable and handle last-waiter/new-waiter race with proper ownership.

Checks on ca70545a12 are package: success but test: pending — not green.

简体中文

存在开发构建关闭竞态阻断。

[Astro-Han]

Update on 6cafd6fac7:

[P2] Closing build still reusable

runtime-host-setup-package.ts:103-111 reuses developmentBuild while its close is still in flight; immediate retry joins the doomed build and gets stopped.

[P2] SSH terminator lacks incarnation guard

runtime-host-ssh-terminal.ts:997-1002 passes PID to async terminator without hasExited/incarnation check; after exit and before discovery, a reused PID could receive SIGTERM/SIGKILL intended for the old PTY.

Checks on 6cafd6fac7 are package: success but test: queued — not green.

简体中文

存在构建关闭复用与 SSH 误杀两项阻断。