fix(runtime): consolidate runtime recovery safeguards

[luoye520ww]

Problem

Runtime failures were handled by several independent PRs: expected exit classification, crash-loop policy, reconnect UI, renderer recovery, and the error boundary. In isolation they could race each other, lose a composer draft during a health transition, or leave packaged smoke tests clicking an inactive control.

Root cause

Runtime generations and stop reasons were not carried consistently from the process controller to the supervisor. Renderer recovery and reconnect state had separate lifecycle assumptions, while the packaged smoke helper treated a wrapper element click as proof that the extension guest was attached.

Scope

This PR consolidates the runtime recovery chain and the packaged-smoke reliability fix. It keeps the crash-loop breaker as a pure policy module; it does not add a second runtime, safe mode, or unrelated provider/storage features.

Changes

• Classify managed runtime exits by generation and explicit stop reason, ignoring stale and duplicate exit callbacks.
• Prevent watchdog recovery from overriding deliberate failed/stopped states and surface degraded health before restart thresholds.
• Add bounded renderer process recovery with a five-minute attempt window, stable-load reset, timer cleanup, and a user-visible limit notification.
• Preserve composer text, attachments, and file references until a send is accepted, so reconnect races are retryable instead of destructive.
• Add a redacted, bounded renderer error boundary with incident ID, reload, copy-ID, and log-directory actions.
• Make packaged extension smoke target a visible button and use one guarded DOM fallback after a pointer/guest-attach race.

Safety

• Expected settings/provider/app stops are not reported as crashes.
• Older runtime generations cannot trigger recovery for the current child.
• Renderer reloads are bounded and cancelled on disposal or successful load.
• Error logs redact secrets and cap stack/component text; raw renderer errors are not rendered to users.
• Composer state is cleared only after the runtime send path returns success.

Typecheck

npm.cmd run typecheck
npm.cmd --prefix kun run typecheck

Both passed.

Tests

npm.cmd exec vitest run src/main/runtime/crash-loop-breaker.test.ts src/main/kun-runtime-supervisor.test.ts src/main/runtime/kun-process-controller.test.ts src/main/renderer-process-recovery.test.ts src/renderer/src/components/AppErrorBoundary.test.ts src/renderer/src/components/RuntimeStatusBanner.test.ts src/renderer/src/components/workbench/useWorkbenchComposerSubmitController.test.ts src/renderer/src/lib/runtime-banner-visibility.test.ts src/renderer/src/store/chat-store-thread-actions.test.ts scripts/smoke-packaged-extension-desktop.test.cjs
npm.cmd run lint
npm.cmd run build
git diff --check upstream/develop...HEAD

Results: 9 test files, 76/76 tests passed; lint, build, and diff check passed.

Actual validation

• Runtime process-controller, supervisor reducer, renderer recovery, composer, error-boundary, reconnect banner, and packaged-smoke tests run locally.
• Root and Kun typechecks and the full renderer/main/Kun build completed locally.
• Packaged Linux, Windows, and macOS validation is required and will run on this PR.

Review performed

• Functional correctness
• Runtime generation/concurrency and stale callbacks
• Recovery and timer lifecycle
• Draft/attachment data integrity
• Secret redaction and error exposure
• Cross-platform packaged smoke behavior
• Scope and test quality

PR size

Production files: 17
Test files: 11
Production LOC: 895
Total diff: 1,279 lines

Non-goals

• Crash-loop breaker remains a pure policy; Supervisor integration is not added here.
• Safe mode runtime/UI is not included.
• No Provider, IPC/SSE, storage, or workspace migration changes are included.

Supersedes

• fix(renderer): make workbench errors recoverable #888
• fix(runtime): classify expected and unexpected process exits #889
• feat(runtime): add pure crash-loop breaker policy #891
• fix(runtime): preserve the workbench across reconnects #892
• fix(renderer): recover from bounded process failures #894

Part of #885; this PR does not auto-close the umbrella issue.

[XingYu-Zhong]

感谢针对白屏/运行时恢复的投入。关闭当前聚合 PR 的原因是主体能力已在当前 develop 中以另一套实现落地：AppErrorBoundary、RuntimeStatusBanner、主窗口 renderer 恢复、RestartBudget/watchdog 与 shutdown coordinator 都已存在。

当前 PR 因此与核心、UI 和 smoke 路径大面积重叠并冲突，不应再整体合入。

仍有价值的差异请基于最新 develop 单独提交，例如进程 generation 分类，或“仅在发送成功后清除草稿”；每项一个小 PR、带针对性回归测试。当前分支会保留。