fix(session): authenticate readonly managed GC protocol inspection

[snowykr]

Summary

Install the complete read-only managed GC protocol inspector after the externally merged strict-reader prerequisite #6320. This is a functional prerequisite API, not owner production, task admission, or deletion activation.

• Authenticate the configured profile/session root, original protocol root device/inode, binding, journals, migration/tombstone/lease roles and descriptor-bound file bytes/security/identities.
• Reject unknown, replaced, foreign, symlinked and reserved protocol namespaces without initialization, repair, reaping, mutation or blanket hidden-file exclusion.
• Treat strict .gjc-lock-<UUID>.stale quarantine as lock-role inventory only, never deletion permission or arbitrary lease JSON.
• Use the actual read-only path-backed managed store: no native recovery-root open or retained-directory authority. A live lock-fenced inspector factory remains an ephemeral capability, not serialized authority.
• Preserve strict shared owner readers and conservative unsupported-consumer refusal; downstream scanner/storage/managed/SDK/GC consumers install separately.

Exact source and review budget

Base: dc0c6948671740e9363c9ca15359b2edaeba017d (dev, external #6320 merge).
Head: 4fb2f3767744cac7d4455bb28ee559de7a080210.
Both owned-layer and actual dev production additions+deletions: 547 (managed-session-scope.ts 530; managed-session-storage.ts 13+4). Tests 128+1 and changelog fragment 2 are excluded. Total 4 files +673/-5. No stacked-branch base exception or oversized dev PR.

Current exact-head verification

Clean detached QA, exact head before/after:

bun test packages/coding-agent/test/managed-gc-retirement-journal.test.ts packages/coding-agent/test/managed-gc-retirement-codec.test.ts packages/coding-agent/test/task-artifact-owner-transcript.test.ts packages/coding-agent/test/session-storage.test.ts packages/coding-agent/test/gc-disk-retention.test.ts packages/coding-agent/test/task-artifact-owner-retirement.test.ts packages/coding-agent/test/task-artifact-owner-access.test.ts packages/coding-agent/test/managed-scope-owner-only-self-heal.test.ts
# exit 0: 217 pass, 9 existing platform skips, 0 fail, 1,131 assertions; 226 tests / 8 files
bun --cwd=packages/coding-agent run check
# exit 0: vendor verification, Biome and TypeScript

Qualification ID: 10d-independent-after6320-basedc0c6948; retained output and JSON in owning artifacts/task-admission-stack/.

Strict genuine current-source native build: version 0.18.6, addon SHA256 ecca056f0c63eca5139c674999a86ca8f4c32926cb18b4c9804efd0d00c32030, path_identity source SHA256 26555fb71debdd40e0cdb70811847765452facd4cbb4107b646df7cc1a25dcaf; crates-tree parity checked, no QA metadata rewriting or manually stamped loader descriptor.

No-effects tests retain complete bytes/modes/ctimes/private-directory snapshots plus native open/retention spies, original protocol identity pinning, genuine prepared journal authority, strict quarantine validation and malformed/replaced-entry refusal. The historical Linux readonly reaper defect was repaired in #6316; this prefix preserves its true read-only boundary, not a timeout/retry/snapshot waiver.

Preservation and limitations

Original fix/session-move-minimal HEAD 1a12e32f6bbcb5c4a469dd480b4b5dacb37dc95d, 44 staged files +11023/-1453 and no unstaged changes remain untouched. Reference #6240 HEAD 7e5f7ef2a745bc1c3d012362f00be9a441bdeb76 remains clean and unchanged. Neither is closed or rewritten.

Darwin runtime verification only; existing skips/warnings remain visible (2 warnings, 1 info). Linux/Windows runtime execution belongs to fresh code-event CI, not these local receipts. No claimed arbitrary FD revocation, physical reclamation from scrub, LSP readiness, full-stack qualification or repaired published binary. Persistent owner production and post-move admission remain OFF. The inherited full-cardinality reaper timing obligation and final cumulative/frozen cohort/critic audit remain outstanding.

#6320 exact approval and successful CI establish its prerequisite installation only; they do not approve this head. Require fresh code-event CI and exact-head write-access maintainer review. Leader does not merge.

[probepark]

Review (head 4fb2f37, gajae-reviewer on behalf of probepark)

CI: green. All non-gate checks pass, including Affected path validation / check:@gajae-code/coding-agent, test:packages/coding-agent/test/managed-gc-retirement-journal.test.ts, Virtual integration validation and gjc-state-gates. The only red items are the human-approval gates.
Scope: +673 / -5 across 4 files. Changes are in packages/coding-agent/src/session/internal (managed-session-scope.ts, managed-session-storage.ts), one test, and one changelog fragment. Reviewable lines: 547.
Conventions: changelog fragment changelog.d/task-owner-protocol-inspection.md present. No generated files, no console.*, no mock.module. No labels.
Notable:

• managed-session-scope.ts (new managedGcProtocolScopeInspectorForScope): the inspector checks dev, ino, mtime, ctime and mode before and after each read, for the protocol root, every role directory and every file. It reads files only through store.readExpected. It rechecks the journal set at the end (deepSame(latestJournals, journals)), and store.close() runs in finally. I found no write, repair or unlink path. Unknown names fall through to role-specific validators, which throw (fail-closed).
• managed-session-scope.ts, binding parse (JSON.parse(binding.bytes…)): this sits outside a try, so a malformed binding surfaces as a raw SyntaxError and not as managed_gc_scope_authority_mismatch. It is still fail-closed. Non-blocking: wrapping it would give a consistent error code.
• The new exported inspectors have no production caller yet. This is consistent with the PR description ("prerequisite API, not … deletion activation"). Tests use the real filesystem and native store. The spyOn(native…) spies are restored in finally.
  Blocking: none

Body verdict line count=0, not updated. Suggested verdict line: gajae.pr-review-verdict.v1 merge-approved sha256:192cc7d21e102c835073afb895f59dbbf5e3a1138479eb644e4dabb7104841e7 reviewer:human reviewer-id:probepark evidence:ci-green;affected-check-coding-agent-pass;readonly-inspector-no-mutation-path;spy-restore-checked

Verdict: gajae.pr-review-verdict.v1 merge-approved sha256:192cc7d21e102c835073afb895f59dbbf5e3a1138479eb644e4dabb7104841e7 reviewer:human reviewer-id:probepark evidence:ci-green;affected-check-coding-agent-pass;readonly-inspector-no-mutation-path;spy-restore-checked