Extension: attach mode — server modes, identity-verified, never-fork

[aarontrowbridge]

Important

Scope. Slice 2 of Managed Fleet (#283 — read it first). The extension learns to attach: three machine-scoped Server modes (standalone default / server / client); in non-standalone modes the extension never spawns a server — it attaches to a configured URL after verifying the identity handshake (role, fleet id, pinned instance id) and presenting the fleet token. standalone keeps today's spawn behavior untouched.

Acceptance Criteria

1. Never fork: with client mode active and the attach port completely free, activation spawns no server process and creates no local store; chat disables with actionable copy offering reconnect or Local fallback. (Regression test for the 2026-08-07 incident class.)
2. Attach succeeds only when the handshake returns role canonical, the configured fleet id, and the pinned canonical instance id; each mismatch class (wrong role / wrong fleet / wrong instance / unreachable) fails with its own explicit, actionable error.
3. All fleet settings carry machine scope; a static assertion test fails if any fleet setting is syncable.
4. server mode attaches to the local service via the exact code path client mode uses, minus the tunnel (one attach path).

Testing Decisions

Extension test suite (packages/extension/test, reuse-first): attach-path tests against a fake identity server (fixture payloads per mismatch class); never-fork test asserting no spawn and no store creation when the port is free; settings-scope assertion against the contributed configuration; server-mode/local-attach path test. Extends the existing server-manager test surface rather than creating a parallel one.

Key Decisions & Constraints

• Attach is a first-class mode of the server manager, not an error path: spawn is standalone-only, by construction.
• The pinned instance id is written at connect-time (slice 3's bootstrap), not typed by the user.
• Fail-closed is the product behavior: an unreachable or mismatched server disables chat with copy that names the repair, never a silent retry loop.
• Parent constraints apply; slice-local: no spawn primitive may remain reachable from non-standalone modes.

Source

Part of #283 · Design: docs/adr/0005-managed-fleet.md (PR #282) · Blocked by #284 (the identity route it verifies).