Add strict hosted runner execution adapter

[abrichr]

What changed

This PR completes Flow's hosted-runner boundary for the target-state product. The adapter verifies the seven admitted product releases, the exact workflow admission, the installed Flow, Desktop, and Capture builds, the protected local runner origin, the trusted bundle, and the staged deployment profile before a managed child can start.

Runtime parameters now keep their JSON scalar types from the hosted wire through local resolution, authorization, checkpoints, the private child file, and the retained report. String lookalikes remain strings. Booleans remain Booleans. Finite numbers use the same canonical spelling and digest in Python and JavaScript. Flow refuses objects, arrays, null, non-finite numbers, unsafe integer spellings, and hosted parameter names outside ^[A-Za-z_][A-Za-z0-9_]{0,127}$.

Flow signs openadapt.production-terminal-verification/v2 only after it revalidates the product release, workflow admission, retained authorization, delivery permit, acknowledgment, receipt, report, effect evidence, and exact run identity. It writes the full report only inside the owner-private run directory. The callback carries the canonical terminal-v2 envelope and digest, which contain no parameter values or full report.

Crash recovery no longer needs the original dispatch or its parameters. HostedRecoveryBinding retains the exact callback lease state. A lost response, missing receipt, malformed report, or failed terminal proof returns RECONCILIATION_REQUIRED, and the one-use ledger prevents a blind retry.

The adapter also exposes the protected runner origin and the register-only renewal header contract. The current runner token can appear as x-openadapt-runner-renewal-token only on the exact register request. It doesn't enter any request model, callback, report, or audit payload. A missing token omits the header.

This change sets the next Flow release to 1.34.0. The published 1.33.0 wheel can't be reused because it doesn't contain the hosted adapter.

Verification

• 393 exact-head hosted, runner, authorization, effect, profile, CLI, and durable-authority tests passed after the clean rebase onto current origin/main.
• Mypy passed all 251 source files. Ruff and the whitespace checks passed.
• The 1.34.0 wheel and source distribution built from the exact rebased head. The release and source-boundary validator passed both artifacts.
• The built wheel reports version 1.34.0 and imports HostedRunnerAdapter, RUNNER_RENEWAL_HEADER, and registration_renewal_headers.
• Exact-head GitHub CI passed all 15 executed checks. Three path-inapplicable checks skipped, and none failed. The main suite passed 5,302 tests and skipped 38. The separate installer suite passed 22 tests and skipped three. Required safety-path coverage was 86.06%.
• Earlier disjoint local shards passed 2,003, 805, and 690 tests. A fourth shard reached 767 passes with no failure before a pre-existing high-cost Scrypt test was stopped after ten minutes.

The uncertain-delivery tests cover a lost backend response, a lost acknowledgment response, an unavailable receipt, and a malformed terminal report. Each case permits one possible actuation, returns RECONCILIATION_REQUIRED, and refuses a replay.

Release order

1. Merge this PR and publish the exact Flow 1.34.0 artifacts.
2. Create the reviewed release admission for those exact artifacts.
3. Pin Desktop to openadapt-flow==1.34.0, then release and admit Desktop.
4. Provision the protected runner configuration, signer registries, revocation state, evidence key, admitted bundle, and deployment profile.
5. Apply the reviewed Cloud migration, deploy the paired routes, and run the configured reference campaign.

This PR stays draft. It doesn't publish Flow, create an admission, apply a migration, deploy a service, or change a secret. A current VERIFIED or Production claim still requires the coordinated release and reference campaign.