fix: exit host runtime when official app-server closes

[mouzhi]

Summary

• treat official app-server stdout EOF or process exit before Desktop input as a fatal Host Runtime lifecycle failure
• allow a bounded 250 ms output drain, then close blocked streams so the shim/launcher can recover instead of leaving a false-healthy Host Runtime
• make backpressured JSONL writes reject when their stream closes, preventing cleanup promises from waiting forever
• preserve successful Desktop-first and explicit Host shutdown behavior

Incident evidence

On macOS, the CodexHost launcher, shim, and Host Runtime remained alive after the owned official Codex app-server child had disappeared. The Desktop connection therefore looked connected while all six request slots were occupied; model/list, config/read, permissions, plugins, and MCP requests expired in the queue. A controlled restart restored the official child and immediately restored a 43-model model/list response.

Validation

• regression test failed before the fix with timed-out, then passed after the lifecycle change
• packages/host-runtime/test/app-server-host.test.ts: 115 passed
• focused protocol/lifecycle tests: 118 passed
• npm run lint: passed
• npm run typecheck: passed
• npm run test:typescript: 173 files passed, 1 skipped; 1495 tests passed, 15 skipped
• npm run check:rust: passed
• focused Prettier check for all four changed files: passed
• cargo fmt --all --check: passed
• independent standards, spec, and lifecycle-race reviews: no remaining blockers

npm run format:check is currently blocked by two pre-existing origin/main formatting failures outside this diff:

• packages/host-runtime/test/remote-host-lifecycle.test.ts
• packages/renderer-extension/src/settings/windows-update.preview.html

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[mouzhi]

CI note: the failing Check jobs stop in the repository-wide format:check before lint, typecheck, or tests run. The job log reports only these two files, both unchanged from origin/main and outside this PR:

• packages/host-runtime/test/remote-host-lifecycle.test.ts
• packages/renderer-extension/src/settings/windows-update.preview.html

The four changed files pass a focused Prettier check. Locally, npm run lint, npm run typecheck, npm run test:typescript, npm run check:rust, and the focused lifecycle/protocol tests all pass. I am keeping the unrelated baseline formatting changes out of this lifecycle fix.