ci(track-a): bootstrap canonical runtime from trusted main

[blakinio]

Track A RUNTIME fresh-main continuation

Task: OTC-20260816-track-a-canonical-runtime-e2e
Base: current trusted main@259e418b2c526f93bd697f07c42b73b1fd40a914.
Execution: physical synology-otclient-01, serialized canonical runtime only.

This PR supersedes stale read-only PR #358 after canonical bootstrap/rebind/Gate-B implementation #371 and archive #375 reached trusted main.

Phase 1 objective

Perform canonical bootstrap without account login or credentials:

1. fresh authoritative lease status;
2. acquire exact task/session lease;
3. run trusted-main bootstrap supervisor, which re-proves registration/candidate absence under the canonical flock;
4. create one persistent exact-fenced official Linux client + X11 + localhost-only VNC + canonical-owned WARP helper;
5. atomically publish the authoritative runtime registration;
6. pass immediate Gate B under the same lease generation;
7. release controller authority while leaving the registered desktop/VNC/client alive idle.

No account credentials are read or typed in this phase. Track B and historical PR #303 runtime surfaces are excluded. Current :98, 6082, PID/session remain unclaimed until this workflow proves the actual selected values.

If bootstrap succeeds, the temporary workflow will be removed and sanitized registration evidence persisted before coordinator handoff. The next protected login phase will first reclassify fresh admission/rebind/Gate B and re-evaluate its credential authorization boundary.

No owner-funded Codex/OpenAI API/paid AI quota is authorized or used.

[blakinio]

Coordinator disposition: SUPERSEDED by fresh trusted-main RUNTIME PR #381 after toolroot repair #379 and archive #380. #376 remains historical fail-closed evidence only: run 31952484701/job 95177998199 reached synology-otclient-01, acquired lease generation 1, failed before X11/client registration with xvfb_unavailable, published no registration, and triggered transition rollback. Do not retry this stale branch.