feat(runtime): consolidate tool and process lifecycle contracts

[luoye520ww]

Problem

Tool execution budgets and child-process lifecycle tracking were split across four small PRs. The contracts were not reviewable as one unit, and terminal PTY processes were not represented in the shared lifecycle registry.

Root cause

There was no bounded, shared resource contract for tool processes and no main-owned registry that could identify children by owner and cleanup policy. Terminal sessions therefore had local cleanup only.

Scope

This PR consolidates the tool budget contract, managed child-process contract/registry, and built-in terminal PTY registration. It deliberately does not claim that every shell, LSP, Whisper, extension host, or subagent has been migrated; those are follow-up integrations.

Changes

• Add a strict ToolExecutionBudget contract with timeout, output, process, memory, CPU, and network-policy bounds.
• Add defensive, main-owned ManagedChildProcessRegistry snapshots with duplicate protection, owner filtering, updates, idempotent removal, and drain.
• Register terminal PTYs in the shared registry and remove them on exit, dispose, renderer destruction, or app shutdown.
• Preserve the existing terminal behavior and native-module fallback; registration failure kills the newly spawned PTY instead of leaking it.

Safety

• Budgets are strict and bounded; network defaults to none.
• Registry records are schema-validated and returned as frozen snapshots.
• PTY registration is completed before the session is exposed; a failed registration immediately kills the PTY.
• Cleanup is caller-owned and explicit; the registry never guesses how to terminate arbitrary processes.

Typecheck

npm.cmd run typecheck
npm.cmd --prefix kun run typecheck

Both passed.

Tests

npm.cmd exec vitest run src/shared/managed-child-process.test.ts src/main/services/managed-child-process-registry.test.ts src/main/terminal/terminal-pty-ipc.test.ts
npm.cmd --prefix kun test -- tests/tool-execution-budget.test.ts
npm.cmd run lint
npm.cmd run build
git diff --check upstream/develop...HEAD

Results: 3 root test files / 10 tests passed; 1 Kun test file / 3 tests passed; lint, build, and diff check passed.

Actual validation

• Contract and registry lifecycle tests execute against real Zod schemas and in-memory state.
• The terminal helper was exercised through registerTerminalProcess with a real registry.
• A direct node-pty ConPTY smoke attempt was made twice on this Windows host, but the host did not emit onExit for the spawned shell before the watchdog timeout. This is recorded as an external host limitation, not reported as a passing PTY smoke test.
• Packaged Linux/Windows/macOS validation is delegated to the required GitHub PR checks.

Review performed

• Functional correctness
• Architecture and state ownership
• Process lifecycle and cleanup races
• Data and resource bounds
• Security defaults
• Cross-platform build compatibility
• Scope and follow-up boundaries

PR size

Production files: 6
Test files: 3
Production LOC: 214
Total diff: 343 additions

Non-goals

• No shell/LSP/Whisper/extension-host/subagent migration in this PR.
• No CPU/memory enforcement implementation; this PR defines bounded fields for later platform-specific enforcement.
• No change to terminal UI or public IPC payloads.

Supersedes

• feat(security): define tool execution budgets #901
• feat(runtime): define managed child process contract #903
• feat(runtime): add managed child process registry #905
• feat(terminal): register PTY processes for lifecycle cleanup #906

Part of the broader runtime resource-governance work; no issue is auto-closed by this PR.

[XingYu-Zhong]

感谢工具和进程生命周期方面的工作。关闭当前聚合 PR 的原因是它同时引入工具预算、子进程注册表和 PTY 登记；当前 develop 已有实际的 Agent Loop 预算控制和终端退出清理，而新 registry 仍是局部实例，尚未成为统一生命周期 owner，CPU/内存预算字段也没有执行机制。

请不要合入一个未被真实调用链使用的聚合合同。后续可基于最新 develop 分成小 PR：一个先定义并接入真正的中央进程 owner，或一个实现可执行、可测试的工具预算。当前分支会保留。