feat: add independent managed SSH agent packages

Managed SSH previously tied remote Agent and Runtime artifacts to desktop
packaging and Host activation. Settings now manages verified Linux x64 and
arm64 .gbagent packages explicitly, with source-aligned download and update
plus offline import and export. Each package contains the signed Agent, pinned
Node, and compatible OpenCode Runtime, and project activation never downloads
one automatically.

Dedicated native CI and a protected release workflow publish deterministic,
signed cumulative catalogs to GitHub and Beijing OSS without replacing the
desktop Latest release. Desktop packaging is metadata-only, remains independent
of Agent artifacts and signing credentials, and Linux desktop releases add RPM
installers.

The managed SSH path also keeps model credentials in Main, enforces Ask as
read-only, verifies signed Agent and Runtime inputs, preserves ACP recovery, and
reports Host update cancellation and failures accurately.

Release note: 远程项目现可在“设置”中手动下载、更新或离线导入签名 Agent 包，桌面安装包与远程组件发布相互独立；Linux 桌面版同时新增 RPM 安装包。

src/main/execution-space/remote-runtime-request-validation.test.ts

@@ -36,42 +36,30 @@ function descriptor(): SshExecutionSpaceDescriptor {
 }
 
 describe('assertRemoteRuntimeRequestValidated', () => {
-  it('accepts the exact persisted Runtime, Agent, and work mode', () => {
+  it('accepts complete evidence from the current Agent installation', () => {
     expect(() =>
-      assertRemoteRuntimeRequestValidated(
-        descriptor(),
-        { provider: 'opencode' },
-        'ask'
-      )
+      assertRemoteRuntimeRequestValidated(descriptor())
     ).not.toThrow()
   })
 
-  it('rejects Runtime selection and work-mode reuse', () => {
+  it('does not couple current requests to a persisted model profile or work mode', () => {
+    const changedRequestEvidence = descriptor()
+    changedRequestEvidence.runtimeValidation = {
+      ...changedRequestEvidence.runtimeValidation!,
+      runtimeSelectionKey:
+        'opencode:00000000-0000-4000-8000-000000000099',
+      workMode: 'execute'
+    }
+
     expect(() =>
-      assertRemoteRuntimeRequestValidated(
-        descriptor(),
-        {
-          provider: 'opencode',
-          profileId: '00000000-0000-4000-8000-000000000001'
-        },
-        'ask'
-      )
-    ).toThrow('Runtime 选择已变化')
-    expect(() =>
-      assertRemoteRuntimeRequestValidated(
-        descriptor(),
-        { provider: 'opencode' },
-        'execute'
-      )
-    ).toThrow('仅验证了 Ask')
+      assertRemoteRuntimeRequestValidated(changedRequestEvidence)
+    ).not.toThrow()
   })
 
   it('rejects missing or cross-installation evidence', () => {
     expect(() =>
       assertRemoteRuntimeRequestValidated(
-        { ...descriptor(), runtimeValidation: undefined },
-        { provider: 'opencode' },
-        'ask'
+        { ...descriptor(), runtimeValidation: undefined }
       )
     ).toThrow('缺少完整')
     expect(() =>
@@ -82,9 +70,7 @@ describe('assertRemoteRuntimeRequestValidated', () => {
             ...descriptor().runtimeValidation!,
             agentInstallationIdAtValidation: 'installation-2'
           }
-        },
-        { provider: 'opencode' },
-        'ask'
+        }
       )
     ).toThrow('缺少完整')
   })

src/main/execution-space/remote-runtime-request-validation.ts

@@ -1,18 +1,12 @@
-import type { WorkMode } from '../../shared/assistant-contracts'
-import {
-  agentRuntimeSelectionKey,
-  type AgentRuntimeSelection
-} from '../../shared/runtime-selection-contracts'
 import type { SshExecutionSpaceDescriptor } from './execution-space-resolver'
 
 /**
- * Prevents a request from reusing persisted remote Runtime evidence under a
- * different Runtime selection, work mode, or Agent install.
+ * Prevents a request from combining persisted remote Runtime evidence with a
+ * different Agent installation. Runtime provider, model profile, and Ask /
+ * Execute behavior are validated by the live Runtime path for each request.
  */
 export function assertRemoteRuntimeRequestValidated(
-  executionSpace: SshExecutionSpaceDescriptor,
-  selection: AgentRuntimeSelection,
-  workMode: WorkMode
+  executionSpace: SshExecutionSpaceDescriptor
 ): void {
   const executionValidation = executionSpace.validation
   const runtimeValidation = executionSpace.runtimeValidation
@@ -24,15 +18,4 @@ export function assertRemoteRuntimeRequestValidated(
   ) {
     throw new Error('远程 Project 缺少完整的当前验证，请重新验证')
   }
-  if (
-    runtimeValidation.runtimeSelectionKey !==
-    agentRuntimeSelectionKey(selection)
-  ) {
-    throw new Error('远程 Project 的 Runtime 选择已变化，请重新验证')
-  }
-  if (runtimeValidation.workMode !== workMode) {
-    throw new Error(
-      `远程 Project 仅验证了 ${runtimeValidation.workMode === 'ask' ? 'Ask' : 'Execute'} 模式，请先重新验证工作模式`
-    )
-  }
 }