feat: add managed simulator resource leases

[RxChi1d]

Summary

Adds managed simulator resource leases for supervised simulator build and test workflows.

Included

• Fences blocked operations so end and cancel return an explicit recovery error instead of reporting a no-op success.
• Allows safe -only-testing and -skip-testing selectors while rejecting unsafe managed test arguments.
• Verifies dedicated Simulator shutdown after managed test execution and preserves lease state across success, failure, and uncertain cleanup paths.
• Synchronizes test_sim contract fixtures with the served manifest description.

Validation

• npm test: 260 files, 2899 tests passed
• npm run typecheck: passed
• npm run lint: 0 errors (existing warnings remain)
• npm run format:check: passed
• npm run build:tsup: passed
• npm run test:schema-fixtures: 333 tests passed
• Direct MCP stdio initialize + tools/list: served test_sim description matches the manifest

Device-backed snapshot and smoke suites were not run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 564fb3b. Configure here.}

[cursor]

Managed install still offers next steps

Medium Severity

Managed install_app_sim still publishes ordinary follow-up templates after a successful leased install. Those steps point at open_sim, which managed mode rejects, and at launch_app_sim without operation credentials, so the next recommended call cannot succeed.

 

^{Reviewed by Cursor Bugbot for commit 564fb3b. Configure here.}