feat: add independent managed SSH agent packages

Managed SSH previously tied remote Agent and Runtime artifacts to desktop
packaging and Host activation. Settings now manages verified Linux x64 and
arm64 .gbagent packages explicitly, with source-aligned download and update
plus offline import and export. Each package contains the signed Agent, pinned
Node, and compatible OpenCode Runtime, and project activation never downloads
one automatically.

Dedicated native CI and a protected release workflow publish deterministic,
signed cumulative catalogs to GitHub and Beijing OSS without replacing the
desktop Latest release. Desktop packaging is metadata-only, remains independent
of Agent artifacts and signing credentials, and Linux desktop releases add RPM
installers.

The managed SSH path also keeps model credentials in Main, enforces Ask as
read-only, verifies signed Agent and Runtime inputs, preserves ACP recovery, and
reports Host update cancellation and failures accurately.

Release note: 远程项目现可在“设置”中手动下载、更新或离线导入签名 Agent 包，桌面安装包与远程组件发布相互独立；Linux 桌面版同时新增 RPM 安装包。

src/main/agent/acp-remote-runtime.test.ts

@@ -1246,7 +1246,7 @@ describe('AcpRemoteRuntime', () => {
     ])
   })
 
-  it('routes permission through the authorizer and denies Ask mode', async () => {
+  it('routes Execute permission through the authorizer and denies mutating Ask permission', async () => {
     const client: { value?: AgentSideConnection } = {}
     const outcomes: string[] = []
     const server = fakeServer({
@@ -1306,7 +1306,11 @@ describe('AcpRemoteRuntime', () => {
                 kind: 'reject_once'
               }
             ],
-            toolCall: { toolCallId: 'tool-2', title: 'Write' }
+            toolCall: {
+              toolCallId: 'tool-2',
+              title: 'Write',
+              kind: 'edit'
+            }
           })
           outcomes.push(
             response.outcome.outcome === 'selected'
@@ -1328,6 +1332,98 @@ describe('AcpRemoteRuntime', () => {
     expect(outcomes).toEqual(['allow', 'reject'])
   })
 
+  it('allows only one-shot read permission in Ask mode', async () => {
+    const client: { value?: AgentSideConnection } = {}
+    const outcomes: string[] = []
+    const server = fakeServer({
+      prompt: async ({ sessionId }) => {
+        for (const toolCall of [
+          {
+            toolCallId: 'tool-read',
+            title: 'Read',
+            kind: 'read' as const
+          },
+          {
+            toolCallId: 'tool-search',
+            title: 'Search',
+            kind: 'search' as const
+          }
+        ]) {
+          const response = await client.value!.requestPermission({
+            sessionId,
+            options: [
+              {
+                optionId: `${toolCall.toolCallId}-once`,
+                name: 'Allow once',
+                kind: 'allow_once'
+              },
+              {
+                optionId: `${toolCall.toolCallId}-always`,
+                name: 'Allow always',
+                kind: 'allow_always'
+              },
+              {
+                optionId: `${toolCall.toolCallId}-reject`,
+                name: 'Reject',
+                kind: 'reject_once'
+              }
+            ],
+            toolCall
+          })
+          outcomes.push(
+            response.outcome.outcome === 'selected'
+              ? response.outcome.optionId
+              : 'cancelled'
+          )
+        }
+        const persistentRead =
+          await client.value!.requestPermission({
+            sessionId,
+            options: [
+              {
+                optionId: 'read-always',
+                name: 'Allow always',
+                kind: 'allow_always'
+              },
+              {
+                optionId: 'read-reject',
+                name: 'Reject',
+                kind: 'reject_once'
+              }
+            ],
+            toolCall: {
+              toolCallId: 'tool-persistent-read',
+              title: 'Read',
+              kind: 'read'
+            }
+          })
+        outcomes.push(
+          persistentRead.outcome.outcome === 'selected'
+            ? persistentRead.outcome.optionId
+            : 'cancelled'
+        )
+        return { stopReason: 'end_turn' }
+      }
+    })
+    client.value = server.client
+    const authorize = vi.fn(async () => 'once' as const)
+
+    await collect(
+      runtime(server).run(
+        { ...request, workMode: 'ask' },
+        new AbortController().signal,
+        authorize
+      )
+    )
+
+    expect(authorize).not.toHaveBeenCalled()
+    expect(outcomes).toEqual([
+      'tool-read-once',
+      'tool-search-reject',
+      'read-reject'
+    ])
+  })
+
   it('auto-allows Execute permissions without an external authorizer', async () => {
     const client: { value?: AgentSideConnection } = {}
     const outcomes: string[] = []

src/main/agent/acp-remote-runtime.ts

@@ -255,9 +255,10 @@ function usageEvent(
 /**
  * Generic ACP runtime over an authenticated remote virtual channel.
  *
- * The class deliberately does not claim confinement from ACP itself. Execute
- * is available only when the injected channel attests both sandboxing and the
- * pre-side-effect approval bridge.
+ * The class deliberately does not claim confinement from ACP itself. Ask
+ * permits only one-shot native reads, while the injected channel's read-only
+ * sandbox remains the filesystem boundary. Execute follows the user's full
+ * authorization for the selected SSH account.
  */
 export class AcpRemoteRuntime implements AgentRuntime {
   readonly requiresToolApproval = false
@@ -1655,8 +1656,7 @@ export class AcpRemoteRuntime implements AgentRuntime {
     )
     if (
       !prompt?.open ||
-      prompt.completed ||
-      prompt.workMode !== 'execute'
+      prompt.completed
     ) {
       return permissionRejection(permission)
     }
@@ -1666,6 +1666,16 @@ export class AcpRemoteRuntime implements AgentRuntime {
     const allowAlways = permission.options.find(
       (option) => option.kind === 'allow_always'
     )
+    if (prompt.workMode === 'ask') {
+      return permission.toolCall.kind === 'read' && allowOnce
+        ? {
+            outcome: {
+              outcome: 'selected',
+              optionId: allowOnce.optionId
+            }
+          }
+        : permissionRejection(permission)
+    }
     if (!prompt.authorize) {
       const selected = allowAlways ?? allowOnce
       return selected