feat(runtime-host): expose extensible Host resource snapshots

[M4n5ter]

English

Summary

• Add an authenticated Runtime Host query for bounded snapshots of CPU, effective memory, graphics adapters, storage, and the active default network interface.
• Model resources as unique kind/version envelopes. Known payloads are strictly validated, while older clients can safely retain or ignore unknown resource kinds and future schemas without a protocol change for each new resource type.
• Report cumulative CPU and network observations so consumers derive utilization over their own sampling interval; this PR adds no telemetry history or background monitoring authority.
• Isolate potentially blocking platform probes in one-shot helper processes. Each probe has bounded output and a hard deadline that terminates its process tree, so a stuck OS command cannot stall the Runtime Host.
• Extend the existing diagnostics grant during credential loading so current remote-owner credentials receive the new resource-query facet without re-enrollment.
• Add a dedicated Host resources dialog. It polls without overlap only while open, keeps the management list compact, and does not change WorkHub behavior.
• Use systeminformation for cross-platform graphics, filesystem, and network facts; generated Desktop and CLI license inventories are updated.

The protocol is intentionally useful to a future WorkHub scheduler, but scheduling policy remains outside this PR.

Fixes #4772

Verification

• npx biome check on the resource protocol, collector, probe helper, tests, and dialog
• npm --workspace @maka/runtime-host run typecheck
• npm --workspace @maka/runtime-host run build
• Focused resource snapshot tests: 2/2 passed
• Focused persisted-grant migration tests: 8/8 passed
• npm --workspace @maka/desktop run typecheck
• npm --workspace @maka/desktop run build:main
• Windows workflow source-closure contract: 3/3 passed
• Real WSL probe: all five resource kinds available; default route interface selected
• Native Windows probe: all five resource kinds available; localized default Ethernet interface selected

Review focus

Please review the extensible envelope boundary, credential migration, helper-process lifetime, partial-failure behavior, and the absence of polling outside the dedicated dialog.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex designed, implemented, reviewed, and verified the protocol, collector isolation, Desktop bridge, and Host resources UI.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck, and affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

• 新增经过认证的 Runtime Host 查询，返回有严格边界的 CPU、有效内存、显示适配器、存储及当前默认网络接口快照。
• 每类资源使用唯一的 kind/version envelope。已知 payload 严格校验；旧客户端可以安全保留或忽略未知资源类型及未来 schema，后续新增资源类型无需修改协议骨架。
• CPU 和网络报告累计观测值，由消费者按自己的采样间隔计算利用率；本 PR 不增加遥测历史或后台监控 authority。
• 将可能阻塞的平台探测隔离到一次性 helper 进程。每次探测都有输出上限和硬期限，到期终止整棵进程树，操作系统命令卡住也不会拖死 Runtime Host。
• 在载入凭据时扩展既有 diagnostics grant，使已有 remote-owner 凭据无需重新注册即可获得新的资源查询 facet。
• 新增独立的“主机资源”对话框。仅在打开时进行无重叠轮询，保持管理列表紧凑，且不修改 WorkHub 行为。
• 使用 systeminformation 获取跨平台显示、文件系统和网络事实，并同步生成 Desktop 与 CLI 第三方许可证清单。

协议刻意设计为未来可供 WorkHub 调度消费，但调度策略不属于本 PR。

Fixes #4772

验证

• 对资源协议、采集器、探针 helper、测试及对话框执行 npx biome check
• npm --workspace @maka/runtime-host run typecheck
• npm --workspace @maka/runtime-host run build
• 资源快照定向测试：2/2 通过
• 持久化授权迁移定向测试：8/8 通过
• npm --workspace @maka/desktop run typecheck
• npm --workspace @maka/desktop run build:main
• Windows workflow source-closure 契约：3/3 通过
• 真实 WSL 探测：五类资源均可用，并选中默认路由接口
• 原生 Windows 探测：五类资源均可用，并选中本地化名称的默认以太网接口

审查重点

请重点审查可扩展 envelope 边界、凭据迁移、helper 进程生命周期、局部失败语义，以及独立对话框关闭时完全不轮询的保证。

AI 使用

• 没有生成式工具作出实质贡献
• 生成式工具作出了实质贡献

工具与范围：OpenAI Codex 完成协议、采集隔离、Desktop bridge 与主机资源 UI 的设计、实现、审查和验证。

检查清单

• 测试覆盖该变更且在修复前失败
• lint、format、typecheck 和受影响测试均在本地通过

此 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[jackwener]

Approved at exact head 78fd498585451885b39982878544541fed21a327 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

---

Review notice: This approval was submitted by an automated review agent operated by jackwener and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

[jackwener]

Approved at exact head 43ee630222b8c32a0989ffae03d545b120f867ca at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

---

Review notice: This approval was submitted by an automated review agent operated by jackwener and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.