fix(environment): align package managers with driver runtime

[AsperforMias]

Fill what changed. Use N/A for irrelevant or maintainer-only items. See CONTRIBUTING.md for branch, CLA, generated file, and CI rules.

Summary

• Define one shared writable Environment package-manager set (npm and pip) for Contracts, API validation, and the Web selector.
• Preserve historical apt, cargo, gem, and go values for reads while rejecting new revisions and provisioning with an actionable migration error.
• Guard every revision-producing path, including lower-level persistence, forks, and environment-variable updates, so unsupported managers cannot bypass route-level validation.
• Reuse the asynchronous package-artifact build/Backup/Restore path merged in feat(environments): add reusable package artifacts #345 instead of retaining a second runtime-install path.
• Update apps/driver to the capability manifest and image verification from langgenius/mosoo-agent-driver#48, based on Driver feat(web): replace Debug dropdown with Terminal tab in editor toolbar #49 and fix(blog): remove large rounded-corner card from featured section #50.

Why

• bug(environment): advertised package managers are missing from the Driver runtime #337 was caused by product write capabilities drifting from what the maintained Driver image could execute. That allowed a valid-looking Environment to fail only when a user Run reached Sandbox provisioning.
• feat(environments): add reusable package artifacts #345 now owns reusable npm/pip package artifacts. This PR completes the product contract: one writable set, explicit legacy read compatibility, persistence-boundary enforcement, and a cross-repository check against the Driver image manifest.
• Depends on langgenius/mosoo-agent-driver#48. Merge the Driver PR first. If its merge strategy changes the commit SHA, refresh this PR's apps/driver pointer to the resulting upstream commit and rerun just check before merging.

Closes #337.

Verification

• Commands:
  • just check: passed formatting, docs links, lint, typecheck, all workspace tests, and GraphQL freshness; API reported 1022 tests across 172 files with no failures.
  • just commit-check: passed; the exact upstream/main..HEAD range also passed commit-policy validation.
  • Focused package-manager suites: API 10 passed, Web 3 passed, Contracts 2 passed, Driver artifact contract 6 passed.
  • feat(environments): add reusable package artifacts #345 artifact/build/restore regression suites: 44 passed.
  • Driver feat(web): replace Debug dropdown with Terminal tab in editor toolbar #49 child-process environment regression suites: 17 passed.
  • Driver standalone suite: 205 passed and 4 credential-backed live tests skipped; lint, typecheck, and build passed.
  • Current amd64 Driver image build and isolated-prefix smoke passed for prettier@3.3.3 and six==1.16.0.
  • Missing-npm, malformed-version, and unknown-manager injections all failed during image verification before a user Run.
• Manual steps:
  • Started local Wrangler with the real @cloudflare/sandbox Durable Object and the current Driver Dockerfile.
  • Used Mosoo's production artifact-build function to install pinned npm and pip packages in one Sandbox, created a local R2-backed Sandbox Backup, destroyed that Sandbox, and restored the Backup into a second Sandbox.
  • Applied Driver feat(web): replace Debug dropdown with Terminal tab in editor toolbar #49 runtime child-process environment projection and executed the restored dependencies. Output was 3.3.3, 3.3.3, and 1.16.0 for the Prettier CLI, Node package lookup, and Python import.
  • Confirmed all four legacy managers remain readable, are rejected before D1/R2/Queue/Sandbox artifact access, and appear in the editor with an actionable migration error.
• Not run:
  • Remote Cloudflare production deployment or account-backed platform integration tests.

Source logic, the #337 reproduction path, and the local D1/Worker/Sandbox/R2/Driver injection chain demonstrate that the business consistency fix is effective. The unverified boundary is remote Cloudflare platform integration behavior, not the issue's package-manager consistency contract.

Impact

• User/API/contract changes:
  • New Environment writes expose and accept only npm and pip.
  • Existing apt, cargo, gem, and go rows remain parseable and visible; no stored data is deleted or rewritten.
  • A legacy configuration cannot create a revision, fork, update an environment variable, or provision a Runtime until unsupported rows are removed or replaced.
• Generated files / GraphQL / DB / lockfile:
  • No generated-file changes, GraphQL changes, DB migrations, lockfile changes, caches, or build outputs are committed.
  • Intentionally updates only the apps/driver submodule pointer for the cross-repository dependency.
• Env or config changes:
  • No Worker environment variables or deployment configuration changes.
  • Driver image details remain owned by the dependency PR; no duplicated exact tool-version constants are added to Mosoo.
• Risk and rollback:
  • This is intentionally fail-closed. Legacy cargo, gem, and go values never had a guaranteed maintained runtime. Legacy apt writes are also blocked because OS dependencies belong in the platform image rather than App-local package artifacts.
  • Forks and environment-variable updates create revisions, so those writes are blocked for a legacy configuration until migration. Reads remain available.
  • Missing, malformed, incoherent, or undeclared Driver capabilities fail image verification rather than a user Run.
  • Rollback requires reverting this PR and the Driver PR together; no D1 data rollback is required.

Review

• Closest review areas:
  • Shared read-versus-write package-manager contract.
  • Persistence and artifact fail-fast boundaries.
  • Legacy Environment editor behavior.
  • Driver submodule dependency and merge order.
• Known trade-offs:
  • The writable set deliberately remains npm and pip; adding another manager requires both Driver verification/smoke coverage and product artifact semantics.
  • feat(environments): add reusable package artifacts #345 owns artifact creation and restoration. This PR does not duplicate that subsystem.
  • Local Wrangler exercised the production code paths and container image, but cannot certify remote Cloudflare account behavior.
  • This PR remains Draft until Driver PR feat(web): replace Debug dropdown with direct Terminal tab in agent editor toolbar #48 is merged and the submodule pointer is refreshed to an upstream-reachable commit if necessary.

[Yevanchen]

Driver PR langgenius/mosoo-agent-driver#48’s CI has now been approved and is running.

Once #48 is merged, please refresh apps/driver to the exact commit available on the upstream Driver main branch, rerun just check, and only then mark this PR ready for review.