Runtime: bind host safety services behind RuntimeHost

[oratis]

Summary

• add a core RuntimeHost boundary that owns provider, tools, permissions, hooks, sandbox, auto-mode, and plugin directories
• keep per-turn inputs separate and expose only an explicit mode override
• migrate CLI REPL, headless, LSP, and both VS Code entry points
• retain the desktop renderer loop as an explicit packaging-ADR migration seam
• fix headless SIGINT/SIGTERM cancellation by finally passing its existing AbortSignal to the runtime

Validation

• pnpm docs:check
• pnpm lint (3 pre-existing warnings, 0 errors)
• pnpm format:check
• pnpm typecheck
• pnpm test
• pnpm build
• cargo check --manifest-path apps/desktop/src-tauri/Cargo.toml
• cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml (31 passed)

Stack

Depends on #183, #182, #181, and #180. This completes the first shared-host assembly slice; desktop moves only after the packaging ADR proves its runtime boundary.

[oratis]

Review: approved ✅

RuntimeHost is the right boundary, and the split between host-owned services (provider, tools, permissions, hooks, sandbox, auto-mode, plugin dirs) and per-turn inputs is clean. Exposing only an explicit mode override — rather than letting callers re-supply arbitrary policy per turn — is what stops #181's invariant from being re-openable one caller at a time.

What I checked

• CLI REPL, headless, LSP, and both VS Code entry points are all migrated, so there is no remaining path that hand-assembles a runtime. That matters more than the refactor itself: the previous bug class was "one client assembles it differently".
• The desktop renderer loop is deliberately left un-migrated with a comment pointing at the packaging ADR. Correct sequencing — docs: decide desktop runtime packaging #187 decides packaging, feat: move desktop runtime behind app server #192 actually moves it. Leaving a documented seam beats a premature move.

The headless SIGINT/SIGTERM fix deserves calling out. Headless already constructed an AbortSignal and simply never passed it to the runtime, so Ctrl+C set up a cancellation that could not cancel anything. One-line class of bug, complete loss of function — and exactly the kind of thing a shared host assembly makes structurally harder to reintroduce.

Validation: CI green; full suite green locally at the stack tip.