feat(runtime): expose coordinated promotion control
Installers currently have to reconstruct writer records and daemon readiness outside CodeGraph. This adds a supported runtime-control module and SDK exports for verified identity, stop outcomes, updater reservations, bootstrap claims, release and usable project readiness.
Each reservation carries a unique generation. Acquisition, transfer and removal use the existing native mutation guard, so an old reservation cannot claim or release a successor held by the same PID. Unreadable ownership reports incomplete release. Readiness checks the hello, MCP build and actual project status, and resolves the caller's project path before sending it to a daemon with another working directory.
A bootstrap claims the reservation and runs the selected CLI in that same process. The validated coordination module must remain available separately from the executable across promotion and rollback. Live legacy writers are refused by default; an explicit cutover requires all older MCP sessions and direct or fallback writers to be quiescent. Process launch, services, artifact replacement and rollback policy remain with the installer.
Validation passed: Node24 build, 119 focused Node tests, 15 API cases under Bun, and the full suite (587 files, 7,492 passes, 39 existing skips). Hash-verified original implementations fail the release/readiness/path regressions; the corrections pass. A PID-only ownership mutation fails successor preservation. Real current and older managed CLI bootstrap probes preserve the PID across claim and CLI execution and serve the expected project from another working directory.
The focused cases cover serialized cross-process handoff, same-PID stale reservations, release read failure, usable status versus expected-condition guidance, relative project paths, build mismatch and explicit legacy cutover. The daemon lifecycle job includes these cases on Ubuntu, Windows and macOS.
README rows checked: upstream merge point, daemon replacement/runtime lifecycle, library API and historical retrieval/precision/performance measurements. The pinned upstream point and measured rows are unchanged; runtime-control documentation is added to README and the API reference.
Platform CI caught a path-alias mismatch in the fault-injection test. It now resolves the injected file through native realpath and exercises a directory alias. The test retains both release-preservation assertions and checks that the read error was injected. Native Windows Node 24 probes reproduce the short-path mismatch and confirm that native realpath matches the file path production reads. All 15 runtime-control tests pass under Node and Bun. No further model review ran because these corrections change only the test. Final lifecycle checks passed on Ubuntu, Windows and macOS. The pull request bot review completed with no findings.