feat(track-a): repair canonical bootstrap transition

[blakinio]

Track A RUNTIME-INFRA replacement for #360

Task: OTC-20260816-track-a-canonical-bootstrap-implementation
Base: fresh main@dbd9520e2f8cc5a26f556bffaae2a83e139615f9
Execution: GitHub-hosted only, runtime_access: none, mutation_authorized: false.

This Draft replaces stale PR #360 and directly remediates its four coordinator findings:

• TACOORD-360-001 HIGH — rebind now restores and revalidates the exact previous authoritative registration on any post-publication failure.
• TACOORD-360-002 HIGH — transition/worker argv is aligned and regression-tested against the actual shell parser.
• TACOORD-360-003 HIGH — account login/credential typing is removed entirely from this infrastructure worker; protected login remains a later RUNTIME-owned operation after trusted-main promotion.
• TACOORD-360-004 — no historical PR research(track-a): prove runtime reacquisition stability #303 wireproxy.pid/fixed SOCKS authority is consumed. Bootstrap creates a canonical-owned, marker-fenced userspace WARP helper in its own process group/state using pinned wgcf/wireproxy inputs.

Additional hardening found during replacement review:

• bootstrap/rebind/Gate B now run under a detached cancellation-safe lock-owning subreaper that reuses the promoted PR fix(track-a): retain canonical lease through process-group cancellation #321 guard primitives;
• registration is staged mode-0600 and pre-commit identity/lease/uniqueness is rechecked before atomic publication;
• bootstrap rollback terminates only the bootstrap-owned process group and removes any publication claiming failed success;
• persistent descendants receive no lease capability/test credential environment.

A dedicated ubuntu-latest validator is included temporarily and runs the new transition tests plus promoted guard/lease tests. It will be removed before final promotion after its evidence is recorded.

No Synology/client/X11/VNC/login/runtime mutation, credentials, Track B mutation, owner Codex quota, OpenAI API token or owner-funded paid AI quota is used by this Draft. Current runtime nonclaims remain :98 UNKNOWN, 6082 UNKNOWN, exact PID/session NOT_REGISTERED.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.