Make development runtimes container-portable

[adrianwebb]

Outcome

Containerized development targets can consume live package overlays from the same federated workspace and leave no declared runtime residue when a target or session stops.

Work authority

• Work item / Issue: Closes Make development overlays container-portable and execute cleanup contracts #58
• Proposal / decision: docs/dev-release.md portable development runtime and cleanup architecture
• Assignment / checkpoint: Platform session dev-aeef9dc6-5a2
• Actor: codex-root
• Human authority: adrianwebb
• Agent / capacity provider: Codex local development agent
• Exact base ref: staging at 8c58b30
• Exact head ref: codex/development-runtime-cleanup at b4ad7de

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Replace absolute overlay links with relative links, expose explicit session workspace/worktree identity to project-owned operations, execute declared setup/cleanup around bounded process lifecycle, test the command boundary, and prove the packed CLI artifact. All repository work is complete; Platform installation and live API proof follow release.

Changes and commits

• b4ad7de implements relative overlays, portable operation environment, setup execution, cleanup execution, and focused tests.

Verification

• Clean npm ci --ignore-scripts completed.
• npm run verify:direct passed.
• 41 command-boundary and runtime tests passed.
• Packed-install CLI executable smoke passed and emitted the immutable npm artifact manifest.

Risk and rollback

Setup and cleanup remain unprivileged, project-declared command/argument arrays with existing timeouts. Cleanup runs only for an activated target. Revert b4ad7de to restore the previous behavior; stopping a session with the prior released CLI remains the fallback, followed by the project-declared cleanup command if residue exists.

Completion summary

The generic CLI boundary is implemented and packed-artifact verified. Remaining work is an RC release, Platform/Deployment selection, and the same real API/Admin live-session retry. No production or stable selection changes in this PR.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.