fix: keep valid older agent packages usable after desktop updates

Accept package-declared OpenCode, Node and koffi versions instead of desktop release pins. Preserve signature, hash, protocol and package-internal version consistency checks.

Validate both cached 0.11.18 packages and Linux x64 installation, bootstrap, health and stop. Related regression suite: 326 passed, 1 skipped; unrelated full-workspace check failures are recorded in the remote Host design.

Release note: Desktop updates no longer reject intact older Agent packages solely because their bundled runtime versions differ.

src/shared/agent-installation-contracts.test.ts

@@ -147,7 +147,10 @@ describe('Agent installation contracts', () => {
     ).toThrow('canonical Base64')
   })
 
-  it('requires both locked Linux targets and the fixed Node patch', () => {
+  it.each([
+    ['24.19.0', '3.1.4'],
+    ['24.18.0', '3.1.3']
+  ])('accepts package Node %s and koffi %s versions while requiring valid targets and source', (nodeVersion, koffiVersion) => {
     const target = {
       archive: 'node.tar.gz',
       sha256: digest,
@@ -160,16 +163,16 @@ describe('Agent installation contracts', () => {
         agentVersion: '0.11.0',
         protocol: { major: 1, minor: 0 },
         node: {
-          version: '24.19.0',
-          source: 'https://nodejs.org/dist/v24.19.0/',
+          version: nodeVersion,
+          source: `https://nodejs.org/dist/v${nodeVersion}/`,
           targets: {
             'linux-x64': target,
             'linux-arm64': target
           }
         },
-        koffi: { version: '3.1.4' }
+        koffi: { version: koffiVersion }
       }).koffi.version
-    ).toBe('3.1.4')
+    ).toBe(koffiVersion)
     expect(() =>
       agentRuntimeLockSchema.parse({
         formatVersion: 1,

src/shared/agent-installation-contracts.ts

@@ -239,7 +239,7 @@ export const agentRuntimeLockSchema = z
     protocol: agentProtocolVersionSchema,
     node: z
       .object({
-        version: z.literal('24.19.0'),
+        version: componentVersionSchema,
         source: z
           .url()
           .refine(
@@ -257,7 +257,7 @@ export const agentRuntimeLockSchema = z
       .strict(),
     koffi: z
       .object({
-        version: z.literal('3.1.4')
+        version: componentVersionSchema
       })
       .strict()
   })

src/shared/remote-runtime-launch-contracts.ts

@@ -5,7 +5,8 @@ import {
   agentManifestLicenseSchema,
   agentManifestPathSchema,
   agentProtocolVersionSchema,
-  agentReleaseKeySchema
+  agentReleaseKeySchema,
+  componentVersionSchema
 } from './agent-installation-contracts'
 import {
   agentIdentifierSchema,
@@ -227,7 +228,8 @@ export const remoteRuntimeLockSchema = z
       .object({
         opencode: z
           .object({
-            version: z.literal('1.18.29'),
+            // Installed packages carry their own signed Runtime version.
+            version: componentVersionSchema,
             provider: z.literal('opencode'),
             entrypoint: z.literal('bin/opencode'),
             entrypointIdentity: z.literal('opencode-acp'),