[Dunky13]

Summary

Ordinary launch previously ran setup that copied executable helpers into private support storage and registered login agents. Require explicit installation and keep service code inside the owning app:

Explicit installer -> verify package and drain queue -> publish app -> SMAppService -> readiness
Ordinary launch   -> readiness and approval checks -> queue or setup guidance

• Package canonical helpers and BundleProgram agents inside the app; use native main-app login registration.
• Preserve ownership, queue drain, pending build identities, remote intent, credentials and history through migration, replacement, recovery and removal.
• Retain exact candidate/backup custody, reject unsafe writable executable locations, and cancel scheduler waits during shutdown without dropping installer locks.
• Deliver the explicit installer through Homebrew; users finish runtime setup outside Homebrew's restricted hook sandbox.

Evidence

The branch integrates current main 5ab7db8; all five conflicts are resolved. Required CI is running on the integrated head, alongside local validation job 2161.

• Before: regressions reproduced changed-candidate publication, stranded retry/removal receipts and SIGTERM starvation behind the installer's scheduling lock. After: focused regressions passed, including unchanged denied-approval teardown and stalled-RPC cancellation.
• Full repository validation passed before the last backend fixes (job 2146). Final affected backend, remote and app-services race suites passed (2152); native tests passed with 236 simulated service-management checks and both architectures compiled.
• Universal development ZIP/DMG verification and actual packaged private setup, job execution, safe busy refusal, removal and owned process teardown passed (2153). Original failed witnesses are retained and explained in the committed handoff.
• Real SMAppService registration/approval, Intel runtime, new Developer ID/notarized release acceptance and SentinelOne acceptance remain unqualified. This PR does not claim a confirmed false-positive diagnosis or scanner resolution.

See docs/handoffs/bundle-owned-services.md for the implementation contract, exact validation boundaries and artifact hashes, and the adjacent investigation for the build-58/build-94 source evidence.

Merge Danger

Door: One-way for migrated installations; reverting source is not an automatic service migration rollback.

Blast Radius: Installation

Setup and managed upgrades require drained jobs. Group/world-writable executable locations are refused; the default target is the account's Applications folder. Homebrew upgrade/uninstall manages delivery artifacts and leaves the independently installed runtime in place. No endpoint exclusions or affected-Mac repairs are included. After green CI and merge, the user-authorized release follows the existing signed/notarized main pipeline and immutable-artifact acceptance gates.

Before squash merge, preserve the verified signature policy and exactly one matching maintainer trailer: Signed-off-by: Marc Went <marc@went.io>.