feat(runtime-host): expose peer Mesh transit controls

[M4n5ter]

English

Summary

Expose the Host-owned Peer Mesh transit switch through the CLI and Desktop, with bounded live reservation/circuit status and fixed resource limits sourced from the native endpoint.

Refs #3842

Verification

• Runtime Host, CLI, and Desktop typechecks passed
• 17 focused Runtime Host tests, 6 CLI operator tests, and 23 Desktop management tests passed
• Rust tests (10) and Clippy passed
• Astryx inventory and ASF header checks passed
• Real Desktop flow verified: create Mesh, enable transit, reload, and observe the persisted state

Before:

After:

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented and verified the change under the contributor's direction

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

将 Runtime Host 所有的 Peer Mesh 成员转发开关接入 CLI 和 Desktop，并显示由 native endpoint 提供的有界 reservation/circuit 状态及固定资源上限

关联 #3842

验证

• Runtime Host、CLI、Desktop typecheck 通过
• 17 个 Runtime Host 聚焦测试、6 个 CLI operator 测试、23 个 Desktop 管理测试通过
• Rust 10 个测试及 Clippy 通过
• Astryx inventory 与 ASF header 检查通过
• 已在真实 Desktop 中验证创建 Mesh、开启转发、刷新并恢复持久状态的完整流程

变更前：

变更后：

AI 使用

• 没有生成式工具做出实质贡献
• 生成式工具做出实质贡献

工具与范围：OpenAI Codex 在贡献者指导下实现并验证了本次变更

检查清单

• 测试覆盖本次变更，且缺少变更时会失败
• lint、格式化、typecheck 与受影响测试均在本地通过

本 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[jackwener]

I reviewed exact head 4bc7abdf2aee32cfa0a43708da87ecce0341690c against its stacked base a4e24ccb4b014474ff0daf1b1e5e5a74c04ec69e.

The CLI and Desktop both use the Host-owned peer.mesh.transit.set operation; neither surface creates a second policy authority. The protocol keeps the desired Mesh selection bounded while live reservation/circuit counts and fixed native limits come from the endpoint snapshot. Enable, switch, disable, local, SSH, and framed operator paths preserve explicit string | null semantics, and compatibility epoch 65 correctly fences the closed query/result change.

Runtime Host, CLI, and all Desktop TypeScript surfaces built or typechecked successfully. The 47 focused Runtime Host, CLI, and Desktop tests passed, as did Biome, Rust formatting, and git diff --check. Exact-head hosted CI, admission quality, Windows recovery, package validation, and native platform builds are green.

This approval is scoped to the stacked base. Current main has an independent Mesh-status change that conflicts in peer-mesh/node.ts; the stack must preserve that active-membership filter when it is rebased before landing.

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.