Run a process in the live view

[SaladDay]

Runtime–Harness protocol change: ViewSession.Spawn runs a LocalExec binary as another process in a Session's live view while its Harness runs. The first caller is MiniMax Code's Subagent history reader, which must run with the Harness's isolation: never on the agent host outside the view, and never in a second view. That caller is a separate PR, stacked on this one.

Protocol

• Code: apps/daemon/internal/agent/harness.go adds ViewSession.Spawn and two typed outcomes, ErrNotLocalExec and ErrNoLiveView.
• Docs: contracts/agents-api/harness-onboarding.md § Spawn, and its zh translation with a current source_hash.

Mechanism (sessionview)

• The launcher starts the process. The view's launcher, its PID 1, starts it over the existing control socket. It starts it from the thread that carries the restrictions, so the process runs:
  • as the Harness's user;
  • in the view's namespaces and cgroup;
  • with no capabilities, no_new_privs and the same seccomp filter;
  • in a session of its own.
    The daemon never calls setns. The command travels on a pipe and the stdio descriptors travel with SCM_RIGHTS.
• One spawn at a time. A view runs one spawn at a time. The slot is taken before any descriptor is made and is held until the request settles. The caller's context bounds both the wait and the start. A spawn whose context ends is cleaned up when the process starts late.
• A slow directory blocks one thread only. The forking thread enters the command's directory itself, with the process's file-system identity and with signals blocked. A directory that waits on the world therefore blocks only that thread, in an ordinary syscall, and reaping, signals, the drain and teardown carry on.
• Pids stay with their spawn. One SIGCHLD reaper reaps registered children at any time. While a fork is in progress it leaves orphans alone, so a child that exits before its registration keeps its pid until the registration ties it to its spawn.
• Group signals. A spawn has an ID, and its group is signalled only while its leader is unreaped.
• Bounded replies. Launcher replies never echo request data. A failed control write ends the channel, as a failed read does.

Testing

Privileged sessionview and agenthost suites, with the 7 spawn tests ×50 on all CPUs and with --cpuset-cpus=0.

The MiniMax Code qualification row 9 (Subagents in a view) passes with the stacked caller PR.

Blind review took three rounds. Round 3's two findings are fixed in 6af05a3: the bounded reply, and a context cancelled before Spawn.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}