Make worktree runtime selection deterministic

[bigboateng]

Why this change

Fresh linked worktrees inherit generated Boatstack commands but not the ignored worktree-local helper. Runtime discovery therefore depended on hook activation and could select a stale helper from another checkout.

What changed

• Generate tracked POSIX and PowerShell launchers in every managed repository.
• Resolve only the baked release version and source commit from the Git-common runtime cache.
• Verify manifest identity and SHA-256 before activating the worktree-local runtime.
• Add a hook-independent activate-worktree-runtime helper operation.
• Route generated skills, planning transport, safety admission, flow prescriptions, and documentation through the tracked launcher.
• Add generated ownership, export hashes, release guidance, and failure-closed conformance tests.

Review order

1. boatstack/launcher.go
2. boatstack/cmd/boatstack-helper/main.go and boatstack/runtime_cache.go integration
3. boatstack/planning_transport.go, boatstack/safety.go, and boatstack/flow_control.go
4. boatstack/launcher_test.go and export conformance tests

Evidence

• go test ./...
• go build ./...
• go vet ./...
• python3 -m unittest discover -s .github/tests -p test_*.py
• release-note validate and committed-diff preflight

Operational safety

The launcher never searches sibling worktrees or selects latest. Missing runtime bytes are activation state. Hook trust remains a separate fail-closed safety boundary. Invalid manifests, checksums, symlinks, platforms, versions, and source commits fail before command dispatch.

Known gaps and risks

Windows behavior is covered by generated-contract tests; Windows CI remains the authoritative native execution check.

Rollout and rollback

Publish a Boatstack release, then update repositories through the normal infrastructure update. Reverting this PR restores the previous hook-dependent runtime discovery contract.

Release note

release-notes/2026-08-09-deterministic-worktree-runtime-launcher.md