feat(prime): install managed distributions safely

[rynfar]

Problem

Pylon can authenticate Pylon-managed Prime Agent publications after #226, but it still leaves installation and switching to external tooling. That cannot give users a safe in-product update or rollback path without risking external installs, unverified bytes, active runtimes, or stale settings bindings.

Dependency: #226 is merged. This branch is rebased directly onto its merge commit 9378c6e6906de135a8b38e0e6b2854114621983c.

Fix

• Add an opt-in, Pylon-owned Prime Agent tool store that accepts only signed, immutable pylon-code/prime-agent publications authenticated by the feat(prime): verify managed distributions #226 verifier.
• Install builds side by side by signed build ID. Verify before archive parsing, extraction, or execution. Reject lifecycle scripts and unsafe archive members. Never invoke a downloaded package manager or lifecycle hook.
• Keep stock and custom Prime installs untouched. Persist the complete managed binding so unrelated settings writes keep the selected build and Use stock restores the original external path.
• Fence starts and runtime recovery during switches. Schedule busy maintenance with durable receipts. Serialize status and maintenance process-wide with TTL caches and single-flight publication verification.
• Fetch and verify a publication once for all requested subjects. Keep cleanup away from configured, scheduled, loaded, active, linked, incomplete, or unverified bytes.
• Expose install, update, rollback, use-stock, cleanup, status, progress, and errors in web/desktop Settings. Mobile stays read-only and points host changes to web/desktop. Native Windows returns WSL2 guidance before Prime filesystem, network, provider, or runtime I/O.

Evidence

• Two-commit git range-diff reviewed against b906f7e1b and f201577fa. The binding-fix commit maps exactly; the install commit keeps current Pylon reservation tokens and current Settings availability behavior while adding the maintenance fence.
• Focused managed/verifier/status/maintenance/contracts/UI set: 12 files, 189 tests passed.
• Packaged-smoke static and host-platform set: 2 files, 74 tests passed. The live packaged Prime smoke is Linux/Windows-only and remains covered by the required CI matrix; this host is macOS.
• Contracts, server, desktop, and web typechecks passed. Existing Effect suggestions remain outside this change.
• Release smoke passed.
• vp lint --report-unused-disable-directives <18 changed source files>: 0 warnings, 0 errors.
• vp fmt --check <24 changed files> passed.
• git diff 9378c6e6906de135a8b38e0e6b2854114621983c...HEAD --check passed.
• No browser or packaged app was launched, as requested.

Model: OpenAI GPT-5.6-sol
Harness: Prime Agent (RLM child agent)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.6 KiB	+7 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.6 KiB	−1 B (−0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.2 KiB	57.2 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	+10 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.5 KiB	59.5 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	11	11	0 (0.0%)	21	✅

Baseline: 9378c6e · PR result: 3634ce6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.