refactor(runtime): use owning hosts at process and adb boundaries

[thymikee]

Summary

Part of #3753. Part of #3747.

Pass the owning host through root runtime adapters, app-log processes, provider construction, and Limrun dependencies. Standalone released Android shell/exec-out helpers establish a host scope. Required callers and tests touch 19 files (261 gross lines).

Released examples remain valid: runAndroidShell(device, ["id"]) and runAndroidExecOut(device, ["id"]). These process captures remain until #3759.

Third layer, based on #3827. #3823 remains the top gate layer.

Validation

Head 9a16be131286b7535a3b44b245d21cf71d82c140.

pnpm check:affected --run --base chore/process-globals-replay --head 9a16be131286b7535a3b44b245d21cf71d82c140 passed; receipt run-MGFRWP, exactCommit=true.

Coverage failures were fixture races: 7e2cae20ed replaces a directory-order assumption with explicit files; 288e6cceae waits for bridge evidence contents rather than file creation. Both fixes are inherited by all layers. Upper patches are unchanged by range-diff.

Prior full-check and Android daemon/provider evidence stays attributed to e223d37244 in #3823’s review-response comment. This round changes only test fixtures and ancestry. Full coverage and GitHub-owned lanes remain CI obligations.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	5.44 MB	5.44 MB	+737 B
Package (unpacked)	5.44 MB	5.44 MB	+737 B
Package (download)	1.64 MB	1.64 MB	+203 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	43.1 ms	43.3 ms	+0.2 ms
CLI --help	81.9 ms	82.1 ms	+0.2 ms

[thymikee]

Re-ran Apple run 39284526276 once: iOS smoke failed before XCTest with prepare_deadline_expired during runner_rebuild (prepare ios-runner timed out); macOS passed and this layer changes no Swift, so this is a suspected runner setup flake pending rerun evidence.

[thymikee]

Coverage follow-up: 7e2cae20ed fixes the daemon progress fixture by passing explicit files; the failing assertion assumed filesystem directory order. Restacked this unchanged runtime patch to f1d2bce83a; range-diff is identical. Foreground check:affected passed at f1d2bce83a (run-3QImI0, exactCommit=true). CI is running on the pushed head.

[thymikee]

Second coverage fix: 288e6cceae polls the detached bridge’s expected cwd contents; the shell creates the evidence file before writing it, and CI read an empty file (run 39289751890). Head 9a16be1312 inherits both this fix and 7e2cae20ed; upper-layer range-diff is unchanged. Foreground check:affected passed (run-MGFRWP, exactCommit=true). Cold self-review found no issue in the test-only diff. CI is running on this head.

[thymikee]

The code needs one fix before merge: the adb host environment getter regresses a released SDK path at 9a16be1. CI is still pending, with jobs queued, in progress or cancelled by the re-push and no failed logs yet. The diff touches routes that the Coverage, Integration and Android smoke lanes exercise, so a failure there would point at this PR.

The getter in src/platform-runtime-android-adb-host.ts now returns commandHostEnvironment().env. That call throws host_environment_unscoped outside a withCommandHost scope. The public agent-device/artifacts entry, resolveAndroidArchivePackageName in src/sdk/artifacts.ts, loads the same binding through loadAndroidMechanics and opens no scope. When the manifest parse misses, resolveAaptPath in packages/platform-android/src/manifest.ts calls resolveAndroidSdkRoots(undefined, ...), and the default env is requireAndroidAdbHost().environment. The getter throws, the outer catch swallows it, and aaptPathCache is set to null for the rest of the process. A standalone SDK caller now gets no aapt fallback and no error, where it used process.env before this PR. This breaks released behavior (since v0.18.1) that the PR says it keeps. If the first call is unscoped, later scoped calls in the same process lose aapt too. The rule the code must satisfy: every public src/sdk export that reaches code bound to the adb host runs inside a command host scope. The modules that import platform-runtime-android-adb-host or loadAndroidMechanics enumerate those exports (android-adb, artifacts, limrun). Please add one SDK-entry helper that captures the process host and runs the call in withCommandHost, and route artifacts.ts through it. Then add a test that calls resolveAndroidArchivePackageName unscoped on an archive whose manifest does not parse, and check that the aapt fallback still resolves.

Could one src/sdk helper own the default host for all public entry points, instead of wrapping per function? It would capture process once per call and run the call in withCommandHost. It would cover the android-adb shell and exec-out exports, resolveAndroidArchivePackageName, and LimrunRuntime construction and adapters. That would leave one documented place where a process capture lives until #3759. It needs an agreed list of which public src/sdk modules count as entry points under the layering rule in #3753.

I did not run resolveAndroidArchivePackageName unscoped, so this comes from reading the code. I did not check the Android daemon and provider live evidence at e223d37 or the range-diff to this head. I also did not check whether the Limrun adapters left outside the scope (createPortReverse, the archiveDirectory zip, downloadFile) ever reach commandHostEnvironment. I know of no conflicts. Before merge, the SDK-entry scope and its regression test must land, and CI must go green.