feat(runtime-host): coordinate local owner transfer

[me2seeks]

Summary

Add the local-process owner-transfer transaction on top of #3767.

The transaction stages and verifies the exact target before durable intent, then holds the one deployment-authority lock across revision CAS, exact observed-Host cutover, State Root writer release, target activation, Ready verification, and owner commit. A retry re-observes reality: it can recognize the same transaction-scoped target after a caller crash, while post-retirement failures remain truthfully transferring instead of claiming rollback.

An active_work refusal is the only automatic rollback path, and its adapter contract guarantees retirement never began and the previous owner remains runnable. Target staging failures and stale owner confirmations do not retire a Host.

This PR deliberately adds no second deployment journal or lock, no PID/HostEpoch/version authority, no ordinary connectOrSpawn replacement policy, and no remote Client mutation path. Source-specific Desktop, installed CLI, and managed-service adapters remain separate follow-up slices because their launch and supervisor evidence genuinely differ.

Refs #3231
Refs #3709

简体中文摘要

在 #3767 的 durable owner record 之上增加本地进程 owner transfer transaction。

Transaction 先 stage 并验证精确 target，再用唯一的 deployment-authority lock 串行完成 revision CAS、精确 observed Host cutover、State Root writer 释放、target 启动、Ready 验证和 owner commit。Crash 后不会从 PID 或 HostEpoch 续跑，而是重新观察现实；如果本次 transaction 的精确 target 已经在运行，则只重验 Ready 并 commit，不会重复 retirement 或 launch。

只有 Host 因 active work 拒绝、且 adapter 保证 retirement 尚未开始时，才自动恢复旧 owner。Staging 失败或 stale confirmation 都不会 retirement Host。

本 PR 不增加第二份 deployment journal 或第二把 authority lock，不把 version/epoch 当 owner，不把 replacement policy 塞回普通 connectOrSpawn，也不允许 remote Client 修改 Host。Desktop、installed CLI 与 managed service 的 adapter 因 launch/supervisor 证据不同，留作独立后续切片。

Dependency and review focus

• Depends on feat(runtime-host): add durable local deployment ownership #3767. Since refactor(runtime-host): share verified deployment identity #3766 has merged, the current Draft diff against main includes feat(runtime-host): add durable local deployment ownership #3767 plus the transfer transaction; after feat(runtime-host): add durable local deployment ownership #3767 merges, this branch will be rebased onto main and retain only the transaction commit.
• Verify that adapter implementations can prove target_present with a transaction-scoped launch fence or managed deployment evidence, never version alone.
• Verify lock ordering remains owner authority first, then any source-specific supervisor/deployment lock.

Verification

• npm --workspace @maka/runtime-host test — 1160 passed, 0 failed.
• npx biome lint packages/runtime-host/src/operator/local-deployment-owner.ts packages/runtime-host/src/operator/local-process-owner-transfer.ts packages/runtime-host/src/operator/index.ts packages/runtime-host/src/__tests__/local-process-owner-transfer.test.ts — passed.
• Focused owner and transfer suite — 16 passed, 0 failed.
• Full repository test suite was not run.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex designed and implemented the transaction seam, recovery semantics, and tests under user direction. The commit includes a Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No