Add experimental extension lifecycle with native Agent bindings

[Lucas1479]

Problem and resulting behavior

Community TTS, MCP and Skill packages need one install/configure/bind/update/remove lifecycle while preserving each native execution owner. This experimental implementation adds Settings → Extensions, local-wheel private environments, encrypted settings and backend-restart activation. Packages install disabled. Electron owns installation/removal; nonempty Host permissions are rejected; TTS runs through a process-lifetime proxy and selected Work Agents own MCP/Skill execution.

Review map and scope

• Implemented Host profile and limits
• Protocol: Draft extension protocol v0.1 and restart-based Host profile Amadeus-Extensions#1
• Ordinary file/AUIP delivery has been split into Separate registered Work files from verified AUIP applications #189, independently based on main. This PR no longer changes those output boundaries.
• Memory implementation is unchanged. Internal reviews, process evidence and unsubmitted upstream drafts are excluded from the merge diff; this is not a rewrite of the existing branch history.

Review fixes

• Preserve installed records and encrypted secrets on incompatibility or temporary validator failure. Expose their status; never turn a compatibility failure into orphan cleanup. Python validation is asynchronous, with cached synchronous reads.
• Keep ownership markers until deletion succeeds so partial uninstall is retryable. Allow junctions above the managed root while rejecting links at or below it.
• Treat delayed cancellation as outstanding capacity, not a crash: drop late audio, bound outstanding calls and preserve crash budget. Normalize primary language tags and send neutral speed=1.0 without GPT-SoVITS pacing.
• Show package identity, contributions, commands and OS disclosures before installation, updates and enablement; declining prevents dependency execution or the requested activation.
• Persist per-contribution Skill revisions. Adding a Skill preserves existing native sessions; changing/removing a recorded Skill requires a new session. Exact native-path discovery reports shadowed/unavailable Skills without disabling ordinary Agent tasks.
• Repair platform-specific venv test fixtures. Pin schema/validator provenance and check Host-copy drift offline.
• Build the bundled SDK automatically and offline during normal desktop build/dev startup. Source-release policy includes its sources and build entry; Windows packaging ships the resulting wheel and the installer uses the packaged resource path.
• Validate legacy manual MCP migration with a real subprocess, probe and tool call. This exposed and fixed the existing MCP 2 client construction error: launch parameters now enter through the official stdio_client context manager.

Compatibility

Manual MCP probes and Pi stdio calls now receive the platform allowlist plus explicitly configured encrypted environment values. This intentionally changes existing manual connections, including users who install no extensions. Required tokens/toolchain variables must be added under Providers → MCP → Encrypted environment values; arbitrary Host .env inheritance is not supported. Existing version-1 connection records, command/arguments and working directory remain supported. Native Agent launchers retain their own environment behavior; the UI and Host profile explain the distinction. Restoring broad Host credential inheritance is not the migration strategy.

Older experimental session handles with only an opaque Skill digest upgrade when unchanged. A changed legacy digest cannot identify its old contribution set and requires a new session. Newly stored handles support additive bindings.

Validation

• cd electron && npm test: 452 passed on the final code; npm run build: passed. Tests include encrypted legacy-manual-MCP migration/reload and installing from the packaged SDK location when no source-build wheel exists.
• CI follow-up 55551e1: corrected an obsolete manual-MCP mock assertion to inspect the official stdio parameter boundary. Replaced the VN semantic test's 5-second throughput assumption with one 30-second deadlock watchdog; the blocked-model barriers, order, cadence, snapshots and persistence assertions remain. Related MCP/VN suites: 50 passed. With an added 70 ms per real line persistence call, the original watchdog timed out after 60 admissions while both repaired source paths completed all 81 lines and semantic assertions in approximately 7 seconds. This follow-up changes tests only.
• Local rerun of the full previously failing partition, python -X utf8 tools/run_tests.py --shard-count 3 --shard-index 0: 1,872 passed, 6 skipped. Optional-dependency availability differs from CI; this is a local partition result, not the total across CI's three partitions.
• python -m pytest tests/test_extension_sdk_build.py tests/test_mcp_connections.py tests/test_subprocess_environment.py tests/test_release_tooling.py tests/test_mcp_stdio_lifetime.py: 37 passed. An extracted source fixture with no Git checkout/prebuilt wheel runs the desktop SDK build entry, then installs/imports the wheel in a fresh environment offline. A real legacy manual MCP peer fails with ambient-only credentials, succeeds with its explicit binding, retains cwd and cannot read an unrelated Host secret.
• npx electron-builder --win --x64 --dir --publish never: passed; verified the SDK wheel inside the actual Windows application's resources/extension-sdk directory. Source Release and Windows Electron CI also passed on implementation commit 00b2d9d.
• Runner/SDK tests: 35 passed, including four cancellations during slow first-chunk generation with no process restart, followed by successful synthesis.
• Native Skill/session/health/provenance tests: 49 passed, 1 skipped. Real Codex App Server, Codex ACP and Pi processes use controlled model endpoints to discover/read Skills, resume sessions after addition, reject stale revisions and recover from Pi native-name shadowing.
• Native Windows GUI lifecycle: passed with an isolated profile, loopback synthetic model and local tone wheel. Accepted real file-picker/install/enable/update dialogs; selected the voice; restarted; submitted Chat messages that reached the independent Runner and physical playback; updated 0.1.0 → 0.2.0 with old-version retention before restart and process/directory cleanup afterwards; restored Chat history; removed with data retention; verified text-only Chat and visible unavailable voice; reinstalled disabled; explicitly deleted data on removal and verified cleanup. See the Host profile evidence and screenshots. No installer or confirmation handler was mocked.
• Earlier real-wheel lifecycle and hidden production-component settings smokes passed; declined consent is also covered automatically.
• Official tools/smoke_electron_model_less.py: 11 checks passed on the plugin-only branch, including authenticated startup, GUI settings/navigation and clean Electron/backend exit.
• Ruff, architecture/README checks, source provenance verification and git diff --check passed. The companion protocol suite has 61 passed, 1 skipped.

Latest head 55551e1: all 17 CI checks passed, including all three Python partitions, desktop smoke, the aggregate cpu-model-less gate, Source Release and Windows Electron build. On 30d2dc8, Python shard 0 had failed on the stale MCP assertion and VN watchdog; the corrected tests now pass in the full run. Earlier implementation-CI results above refer specifically to 00b2d9d. Local counts are Windows results. The native GUI test used a local synthetic tone and loopback response endpoint, not a paid speech service or remote model; it verifies the real lifecycle/playback path, not speech quality. Prior native Skill/Runner counts describe their unchanged code paths and are not added to this pass's 37-test count. The isolated app exited cleanly and released its backend port after acceptance.

Remaining limits and merge gate

DSH 0.2.0-rc.2 + MCP Client 2.0.0 still emits non-JSON diagnostics for unsupported resource enumeration. Windows DSH workspace-write requires suitable DACL/integrity-label access, including WRITE_OWNER; inadequate locations fail closed. Neither is a blocker for reviewing this disabled-by-default experiment, but both block stable DSH support. There is no parser filter, ACL repair or unrestricted fallback.

MiMo has no Japanese support and its live English acceptance remains deferred. Fish has prior live Japanese evidence, not general listening/performance certification. The bundled SDK delivery gap is fixed; public SDK publication/licensing decisions, other-platform runtime qualification and natural-voice Chat/Wallpaper/VN acceptance remain release work.

Keep draft for Claude/maintainer review. Required CI and review concerns must pass before merge; CONTRIBUTING.md also requires a linked design Issue. This PR does not claim release readiness.