Keep runtime hydration repository neutral

[bigboateng]

Summary

• require exact version and checksum evidence before hydrate changes host storage
• allow hydration from detached checkouts without repository mutation
• preserve an existing shared launcher while restoring an older pinned runtime
• honor the final repeated --format value in bootstrap diagnostics

Follow-up to #216.

Verification

• all 345 Go tests
• repository contract: 19 tests, 1 expected failure
• go vet ./... and go build ./...
• TypeScript Flow SDK build
• release-note contract and diff check
• local detached Todo-Test-compatible hydration proof

The Windows CI shard exercises the PowerShell detached-hydrate and shared-launcher boundary.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.96

The installer changes appear consistent with hydrate isolation, but repeated-format handling introduces a concrete token-role parsing regression. Model-level verification is not recommended; a focused parser regression test is sufficient.

Findings without inline diff anchors

[P3] Honor option values when selecting diagnostic format

Invariant: bootstrap diagnostics must use the format selected by the CLI parser. With a missing pinned runtime, guard --format=json --command --format=text validly binds --format=text as the value of --command, leaving the format as JSON; this scanner instead revisits that value and resets jsonRequested to false, emitting text. The patch introduces this by replacing the former first-match return with continued scanning. JSON automation then fails to decode the recovery diagnostic. Add an integration test invoking a missing-runtime launcher with these arguments and asserting that stderr is valid JSON; parsing must distinguish flags from other flags' values.

Confidence: 0.98

Location: boatstack/internal/runtime/bootstrap_diagnostic.go:105-106 (RIGHT)

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.96

The hydration changes appear consistent, but the revised bootstrap-format scanner introduces a deterministic protocol mismatch for valid flag values that resemble format options. Model-level verification is not recommended; a focused parser/rendering regression test is sufficient.

Findings without inline diff anchors

[P2] Do not interpret another option's value as the final format flag

Invariant: bootstrap diagnostics must use the format that the CLI parser would assign to --format. With a missing pinned runtime, boatstack guard --format=json --command --format=text reaches bootstrap rendering before normal parsing; Go's flag parser treats --format=text as the value of --command, leaving the requested format as JSON, but this scanner revisits that token and emits text. A --repo value named --format=text has the same failure. The patch introduces this by continuing past the real format flag and overwriting its result without tracking other options' operands, so JSON automation receives a non-JSON failure envelope. Add a rendering test with the arguments above that asserts the output decodes as JSON; the inverse ordering should likewise remain text.

Confidence: 0.98

Location: boatstack/internal/runtime/bootstrap_diagnostic.go:105-106 (RIGHT)