feat(runtime-host): manage peer meshes from Desktop

[M4n5ter]

English

Summary

Complete the operator and Desktop management slice for experimental Runtime Host Peer Meshes:

• add owner-only Runtime Host operations for querying, creating, inviting, joining, removing, leaving, closing, and reconciling a Mesh
• keep durable Mesh state scoped to the native peer identity and keep one-time invitations out of process arguments
• expose the same closed management vocabulary through the CLI, local Desktop, and SSH-managed Hosts
• add a compact Desktop surface for identity, roster revision, route state, invitations, and membership changes

Remote principals do not receive these operations. Manual direct-peer listeners remain direct-only; managed peer services opt into resident Mesh state explicitly.

Refs #3842

Verification

• npm run build
• npm run typecheck
• npm run lint
• npm run format:check
• npm run astryx:surface-inventory
• npm run check:asf-headers
• npx knip --workspace apps/desktop
• npx knip --workspace packages/ui
• 55 focused Runtime Host, CLI, and Desktop tests
• visible Electron walkthrough of create and invite flows
• real macOS Desktop ↔ Linux Host join, route reconciliation, member removal, persistence across restart, and clean shutdown

Screenshots

Two-member cross-machine Mesh after reconciliation:

The same Desktop Mesh persisted after restart:

简体中文

概要

完成实验性 Runtime Host Peer Mesh 的 operator 与 Desktop 管理闭环：

• 新增仅 Owner 可用的 Mesh 查询、创建、邀请、加入、移除、退出、关闭和同步操作
• 按 native peer identity 隔离持久 Mesh 状态，一次性邀请不会进入进程参数
• CLI、本机 Desktop 与 SSH 管理的 Host 共用同一组封闭的管理操作
• Desktop 以紧凑界面展示身份、roster revision、路径状态、邀请和成员变更

Remote principal 不会获得这些操作。手动 direct-peer listener 仍保持 direct-only；只有 managed peer service 会显式启用 resident Mesh state。

关联 #3842

验证

• npm run build
• npm run typecheck
• npm run lint
• npm run format:check
• npm run astryx:surface-inventory
• npm run check:asf-headers
• npx knip --workspace apps/desktop
• npx knip --workspace packages/ui
• 55 个聚焦 Runtime Host、CLI 与 Desktop 的测试
• 在可见 Electron 窗口中验证创建和邀请流程
• 真实验证 macOS Desktop ↔ Linux Host 加入、路径同步、成员移除、重启持久化和干净退出

截图

英文部分中的截图分别展示了真实跨机器的双成员 Mesh，以及 Desktop 重启后的 Mesh 持久化结果。

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with implementation, tests, cross-machine verification, and pull request preparation under the contributor's direction. Human review and merge approval remain pending.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[jackwener]

I reviewed exact head c1615f761e613c50843fca43bac3b91bc4bf5b1a and found no blocking issue.

The new management surface preserves the important authority boundaries: Peer Mesh operations are absent from the closed remote-owner grant list, managed SSH connects through the Host's local-owner channel, and one-time invitation material is sent over stdin rather than process arguments. Persistent state is namespaced by the native peer identity, the protocol change advances the compatibility epoch to 61, inputs and projections are bounded, and the current-main synthetic merge is clean.

One non-blocking follow-up: peer.mesh.reconcile currently maps every thrown error to “could not reach any current route.” Reconciliation can also persist route or roster updates, so PeerMeshPersistenceError and PeerMeshPostCommitError should retain the same persistence_failed / commit_outcome_unknown classification used by the other Mesh mutations. The operation is fail-closed and reconciliation is idempotent, so I do not consider this an approval blocker, but the current message can misdiagnose a storage failure as network unavailability.

The exact-head hosted workflows were still running when I submitted this review.

---

Posted by an automated review agent operated by @WAWQAQ. This is not an
independent human review and does not satisfy the committer review required by
CONTRIBUTING.md. A human is accountable for this comment — please push back if
anything here is wrong.

简体中文

本条评论由 @WAWQAQ 运行的自动化审查程序发出。它不构成 CONTRIBUTING.md
所要求的独立人类审查，也不能替代人类审查。有人类对本条评论负责，如有错误请直接指出。