feat(browser): compose paired client host lifecycle

[Jinwoo-H]

	Files	Added	Deleted	Net
Test	2	+418	−2	+416
Prod	6	+348	−39	+309

Summary

• Compose the authenticated paired-runtime browser-host lease with the bounded per-page command dispatcher.
• Install exact lease authority synchronously before the first page command can run.
• Keep command-result settlement at a hard maximum of 16 concurrent and 256 unsettled, beneath the same-socket 32-request transport ceiling.
• Close result transport before aborting owned handlers, while preserving cleanup failures and exact page-generation retirement fences.

Why this stage

Draft PR #14557 proves command results can settle on the exact authenticated attach socket, but intentionally leaves desktop lifecycle ownership and the 32-request versus 256-command capacity policy unresolved. This stage closes those two inert composition gaps before any Electron page handler, capability advertisement, or placement activation exists.

The pinned T3Code reference also keeps logical preview metadata on the server while Electron main owns per-tab WebContents registration and queues navigation until the guest exists. Orca follows that lifecycle shape, but retains stricter execution-host proxy partitions, authenticated authority generations, and fail-closed remote DNS.

Causal evidence

On parent 31f812a, the deterministic oracle failed because the composed host module did not exist, eight completed results immediately exceeded a configured four-request ceiling, and excess unsettled results did not fence the lease. The candidate passes synchronous ready-plus-command delivery, bounded settlement, overflow teardown, transport-close-before-abort ordering, throwing and falsy cleanup failures, exact retirement, and late non-cooperative handler settlement.

Compatibility

This remains production-inert. No RPC registration, runtime capability advertisement, client-placement selection, Electron renderer IPC, BrowserPane behavior, server/offscreen placement, SSH or WSL routing, folder/worktree behavior, or browser.screencast.v1 behavior changes. Old and non-v1 peers keep the existing ready/revoked path; future activation must capability-gate this v1-only facade and preserve server placement for older or browserless clients.

Validation

• 50 focused lifecycle, lease, and dispatcher tests passed.
• 810 runtime/browser/shared test files passed: 9,711 tests, with 24 existing skips.
• Full node, CLI, and web typecheck passed.
• Native/type-aware zero-warning audits and changed-code quality passed.
• Reliability-gate, max-lines, formatting, and diff checks passed.
• Cross-version wire compatibility passed 5/5.
• CLI build and executable artifact verification passed.
• Three fresh correctness, lifecycle/compatibility, and security/performance rereviews are clean.

One initial unbounded parallel run had an unrelated shared-client socket test fail to connect; that file passed 19/19 in isolation and the full four-worker rerun passed cleanly.

Remaining activation blockers

• Compose the exact execution-host route, route-scoped Electron session, quarantined WebContents generation, and renderer registration into the command handler.
• Add capability-qualified production registration without changing legacy or server placement.
• Prove headed, headless, and browserless paired-runtime behavior, renderer crash/reload reconciliation, reconnect inventory, and physical macOS/Linux/Windows, SSH, and WSL coverage.
• Keep default client placement and all live migration disabled until those gates pass.

STA-4150

Stacked on #14557. Do not merge.