feat(updater): add secured preparation controls and restart admission

[devswha]

Active-goal checkpoint: native installation core (e143546)

The full goal remains automatic updating and distribution, not preparation-only success. Added immutable revalidated cache input, supported exact-endpoint plugin reconstruction, native installation location checks, a durable PID-bound attempt journal, the official install invocation and a complete installed-bundle verifier. Startup/restart does not invoke this path yet, so installation remains unavailable and this PR remains draft. Successor health acknowledgment/attempt archival, launch/restart recovery, complete G3 ownership and signed QA/release gates are next; none was waived.

Validation: full npm run verify; native 236 tests + 10 build-binding tests; 20,673-entry comparison of the historical isolated B against its archive. This comparison is not a new live A-to-B install. Standard native Clippy still reports unintegrated dead-code APIs; excluding only that warning class is documented, not claimed as final release lint. Exact evidence/next steps: docs/DESKTOP-UPDATER-INSTALL-PROGRESS.md.

The prior remote CI SSOT failure was fixed by 7ef7cda; its Node 22/24 and Linux server checks passed. New native-head remote checks are separate. No production app/key/version/release mutation occurred.

---

Status: preparation and partial restart integration — not a finished auto-updater

Stacked on #50. Keep this PR draft: installationAvailable remains false and native restart explicitly rejects. No production installation, version bump, updater key provisioning or release publication is included.

Latest: runtime admission and unsent draft durability (da8a0c5)

• One production restart authority is injected into HTTP handlers, authentication and existing chat/PTY sockets. The actual handler promise—not response finish or client disconnect—owns the lease. Prepared tokens are invalidated by intervening completion activity.
• Compose real chat/worker/shell readers while every missing required owner remains an explicit blocker. Track OAuth cancellation unwind, title persistence, expired request uncertainty and retiring PTYs without force-draining work. Live worker/SDK and detached-descendant completeness are not claimed.
• Upload and stream ownership spans storage callbacks, descriptor closure and cleanup; exclusive image creation preserves existing file/symlink collisions.
• The actual composer persists unsent text, image Files and queued intents with bounded IndexedDB transactions and stale-write rejection. Preserve route identity, prior committed data and oversized legacy queues. Add explicit recovery retry and restored-intent review, while keeping ordinary text-only background dispatch.
• Independent review regressions were reproduced and fixed: duplicate legacy sends, wrong-project steering acknowledgments, un-retryable recovery/conflicts, silent migration truncation, missing queue notifications and cancelled enrichment launching work later. Stale OAuth UI ownership no longer bypasses admission.

Validation on the frozen source set:

• Full npm run verify passed; source/test/locale SHA256 inventory remained identical throughout final promotion verification and after commit hooks.
• Expanded backend integration: 237 passed; worker: 63 passed; OAuth/SDK: 102 passed, one optional live test skipped.
• Focused final composer/storage/queue DOM tests: 62 passed, with EN/KO error/retry UI and ten-locale parity.
• Desktop cargo fmt/locked tests: 182 passed, one opt-in fixture ignored; build-binding 10 passed. GJC e2e 8 passed; browser-sidecar e2e 3 passed.
• Browser skill QA on an isolated origin verified actual composer File/queue restoration, stable IDs and file hashes, project separation, stale-window conflict rejection, and review without automatic replay. This is not native WKWebView or A-to-B installation acceptance.

See docs/DESKTOP-UPDATE-ADMISSION-IMPLEMENTATION.md for exact scope, evidence and gaps. New remote CI is separate from these local results.

Earlier preparation/control implementation retained

• Native bounded discovery/download/archive/signature/staging and persistent opt-out, with web SemVer beta/stable notification fallback.
• Shared native snapshot/command contract and About UI; desktop status comes only from validated native state.
• Main-view/navigation-bound preparation bridge via private UDS, fresh owned-stdin initialization, cookie/exact Origin, native HMAC proof before view-capability disclosure, kernel peer PID, replay/queue/deadline limits and retirement checks. Ordinary browsers gain no native updater permission.
• Actual compile-bound isolated debug QA app tested About status, automatic-off persistence, manual check, malformed-feed recovery, normal exit, same origin and preference after relaunch. Fixed nonblocking accepted sockets, excessive QA automation socket paths and stale startup status.
• The example journal/profile initializer is QA-only; it is not the product attempt writer/resolver. Prior native Clippy and journal proofs are documented in docs/DESKTOP-UPDATER-QA-PREPARATION.md.
• Parent 49c1010 remote Node 22/24, Linux server and Linux desktop/package/GUI checks passed. Do not apply those results to the new head without checking its own runs.

Installer evidence and remaining gates

Historical official updater 2.6.0 probes used private HTTPS and isolated signed A/B copies. Normal and authorization-path replacements succeeded; the latter was not cancellation. A second probe returned failure with complete A unchanged, but the user cannot confirm the authorization action and privileged-writer classification remains unproved. These historical bundles retain the advertised-11/loader-13 mismatch and are primitive evidence only.

Still required:

• G0 installer cancel/writer/error qualification and actual macOS 13 execution. No known local environment is available; no safety/support gate was waived.
• Remaining producer admission/readers, worker-host background ownership, global draft/attachment/send freeze acknowledgment, safe shutdown with proven owned-server exit and lock handoff.
• Product attempt writer/resolver, pre-server next-launch installation, embedded applying/recovery and interrupted-install behavior.
• Integrated signed/notarized QA A-to-B with data/origin/auth/settings/draft preservation; production updater key custody/backup and release gates.
• First updater-enabled manual DMG bootstrap and a distinct subsequent public release that proves automatic updating.

Exact handoff: docs/MACOS-UPDATER-HANDOFF.md and docs/DESKTOP-UPDATE-ADMISSION.md.