fix(release): repair full-public prerequisites and CLI isolation

[huangruiteng]

The full-public CI sweep failed because the Ubuntu runner lacked zsh, the new native-child dispatcher resolved a registry for unrelated commands, and the Turn CLI exceeded its existing module budget. This installs the required shell, resolves native-child state only when that command is selected, and moves the existing Host-option projection into the existing Turn selection adapter. The new native-child command is explicitly kept on its command-specific help surface.

Original runtime, output, timeout and module limits remain unchanged. The Turn module goes from 1,155 to 1,113 lines; authentication is still resolved once and passed to both readback and launch. This adds no capability, state contract or authority. Frontend and Lark consume the unchanged supported payloads; no settings/editor companion is needed.

Validation on the final head: 190 existing Host-binding/Turn/DSH/native-child tests pass; canonical mypy (19 files), Ruff and diff checks pass. Existing module-size, CLI help/manual, real global-command error/privacy and zsh launch-agent smokes pass; CI workflow contract unit suite: 7 tests pass. Six identical real CLI/File fixture observations match across immutable base and exact head. SDK discovery in that fixture is mocked; it does not claim a live Host launch. The actual Ubuntu workflow and final-source complete release qualification remain pending.

Future-facing refinement uses the existing Turn selection adapter rather than a new module or duplicated authority. Source budgets remain fixed.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Reviewed exact head: 5180@418c646b625408890069b9217fe44b3c28f11ee2.

动机

完整 public-smoke CI 暴露 Ubuntu 缺少 zsh、native-child 初始化误读其他命令 registry、Turn 模块超预算和新命令 help 分类遗漏。本 PR 修复这些可复现发布阻塞。

改动思路

复用相邻 CLI 的精确命令 dispatch guard，让无关命令继续由原 owner 输出 public-safe error。已有 Host 参数转发移入既有 selection adapter；CI 安装实际所需 zsh，原 timeout／size／module budget 全部保留。

具体改动

五个路径，共61行新增、53行删除。Turn 从1155降至1113行，保持1114上限；认证仍只解析一次并由 readback 和 launch 共用。native-child 仍由原 handler 管理，help-only 分类使新命令可审计，默认 help 首屏不变。

关键代码讲解

args.command == "native-child" 将 runtime resolution 放回选中命令的分支，避免坏 registry 让 global error renderer 根本无法执行。managed_executor_cli_binding 原样转发 host、profile、runner、max_tokens 与已解析环境，既有 typed read-model owner 继续决定输出。没有新 authority、state schema、quota 或 optional default。

190项相关测试、canonical mypy19、Ruff、原 module/help/manual/global-error privacy/zsh smokes 通过。相同真实 CLI／File fixture 六场景的 Host 观察在 base/head 一致；六场景的 SDK discovery 明确 mocked；另四个实际 CLI／File／SDK discovery 场景不 mock discovery，base/head 同样一致，没有声称 live Host launch。

对主干的风险

最大风险是 forwarding 丢失参数或新 dispatch guard 改变选中命令行为，现有正负入口与真实 File fixture 已覆盖。生产 footer／settlement／Host launch 没有移动，既有 frontend／Lark payload 与配置不变，无需 companion editor。Ubuntu 的实际 workflow 运行和最终发布源全量资格仍待后续 readback，不把本地 shell 验证说成远端 CI 已通过。

我的整体评价

没有当前作用域阻塞，复现失败直接对应 owning boundary 修复。未来便利性检查复用现有 selection/read-model，减少热文件负担，没有新增抽象或放宽预算。仓库要求 runtime 改动留给 maintainer 合入，因此此 APPROVE 不单独授予自合并权限。

English verdict: APPROVE - 418c646;190focused tests and original scoped checks pass,6actual CLI/File observations match;Ubuntu/final-release qualification remains separately pending.