[SaladDay]

Managed initialization previously executed through sandbox providers while self-hosted capabilities used a separate preparation path. Route initial files, configuration, package/setup operations and Skill/Plugin preparation through the same authenticated daemon protocol, then load the resulting frozen capability snapshot through the common execution flow.

Providers retain placement, capacity, daemon bootstrap and Environment reclamation. Runtime owns local installation and execution; closing an executor preserves the Environment, workspace and capability snapshot. Native adapter differences stay behind the shared contract. Public managed bundles and self-hosted local directories retain their input semantics and resolve through one parser and installed.json.

This change implements Linux and keeps the protocol independent of host paths and operating-system executables. It introduces no historical upgrade compatibility.

Stack: targets the existing PR191 integration branch. Includes the validated Session-executor dependency from PR193. Merging this PR does not itself merge the earlier installation/release stack into main or publish a release.

Validation:

• Protocol, gateway, Runtime preparation and snapshot race tests; Core/API initialization tests with a dedicated PostgreSQL database.
• Real Codex managed and self-hosted acceptance: 4 Sessions / 8 Turns, initial-file/bundle/setup ordering, warm executor reuse, reconnect snapshot reuse, new-Session snapshot refresh, write protection and retained Environment/workspace.
• Independent blind review found two P2 mount-visibility issues. Both received narrow fixes and real isolated read/write/permission regression checks; no outstanding review findings.
• The full server gate and CI remain running on the final test-fixture commit. The user explicitly authorized merging without waiting for this repeat. Prior full attempts failed only on obsolete preparation/node initialization fixtures; corrected Codex full-package race and related PostgreSQL race tests passed. The remaining Claude/MiniMax/Rust/Web checks passed separately. Browser fixtures are left to CI because the server lacks Chrome. No full historical release/E2E matrix is claimed.

The live model acceptance used candidate 108513b. Later changes are the name-guard declarations and two mount-visibility corrections, checked separately with targeted real isolation probes.