feat: unify native daemon and Harness installation

[SaladDay]

User-managed hosts now install and run the daemon through one native installer. Interactive multi-Harness selection and command-line-only installation share validation, pinned components, private credential files and additive reuse. Startup discovers only the verified installed Harnesses. Interruption cancels probes/enrollment and reaps owned processes.

PR #200 has merged the cross-platform daemon processes, shared capability preparation and removal of the Linux inner sandbox. This PR targets that integration baseline. It removes the retired Docker self-hosted installer/download routes and updates README, architecture, installation guides and Connect a host. Managed node installation remains available. Existing environments, data and Session history are preserved; old-version upgrades and migration are unsupported.

Support

• Linux and macOS: Codex 0.153.4, Claude SDK 0.3.269/native 2.1.269, patched MiniMax 0.4.12.
• Windows: Codex and Claude; MiniMax is explicitly rejected. Native Windows CI is required; no manual Windows acceptance is claimed.
• Node 22.22.0/npm and adapter components are bundled. No elevation, runtime Harness installation, automatic repair or system-package installation. System dependencies belong in managed images or the host administrator's setup.

Verification

• Required make check passed on zju/mx, including Core/store integration, Claude adapter tests and 77/77 browser E2E. The gate started at 19ac80f8; subsequent Runtime fixes passed CLI/localworkspace race tests, and final installer selection/repair checks passed the complete CLI race suite. Documentation generation/fact verification passed.
• Native installer CI at 326eaa1e: Linux, macOS and Windows passed. The final eae22005 follow-up changes operator wording only; 40 targeted Web tests, the complete CLI race suite and documentation fact verification passed. No further model or full E2E rerun is needed for those wording changes.
• Fresh independent reviews covered the installer, release packaging, startup/cleanup, credentials, Web and docs. Findings were corrected. A fresh independent review of the last operator-guidance delta found no further issues; targeted validation passed.
• Real Linux Codex/Claude/MiniMax exercised Skill and Plugin MCP. Claude and MiniMax completed two Turns with restart/snapshot reuse; MiniMax public cancellation removed both parent and child processes before same-Session cold recovery.
• Native macOS MiniMax completed installation and a real public Turn with Skill/MCP outputs; native cancel/close descendant tests passed. Test processes were stopped and evidence/data retained.

Limits and evidence

macOS Claude's official ARM64 binary is still killed by SIGKILL before version output on the local machine; signature/hash checks passed, but its cause and manual model acceptance remain unresolved. macOS Codex produced real Skill/MCP effects, then exposed the fixed Core clock-skew bug; post-fix Codex completion verification was blocked by the old test account's exhausted quota. No full post-fix Codex completion is claimed. macOS MiniMax confirmed the fixed Mac-to-Core completion path. Cross-platform isolation and release/update automation are outside scope.

Live acceptance matrix and hashes: ~/.oac/acceptance/native-installer-live-20260929/VALIDATION.md on zju and ~/.parsar/acceptance/native-installer-live-20260929/VALIDATION.md on the Mac. Full gate log: ~/.oac/acceptance/unified-native-installer-check-20260929/make-check-final.log on zju.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}