Pin repository runtime selection to immutable identities

[bigboateng]

Summary

• record a portable version-and-checksum runtime identity per repository
• dispatch through a stable launcher to an exact immutable host-store artifact
• make installation update and reconciliation commit the runtime pin atomically with governed state
• fail closed when the exact artifact is absent or invalid; never select another installed version
• use state schema 2 as a flag-day boundary with no compatibility migration

Boundary conformance

Boundary: repository runtime pin to host runtime execution.

Control law: only the exact Kernel-admitted version, digest, source revision, program fingerprint, and state schema may execute. Candidate bytes must be durable before admission. Refusal and rollback preserve the prior pin.

Coverage includes independent repositories, missing-artifact refusal, nested Git repository isolation, immutable-store collisions, portable pins, workspace projection, program-changing update reconciliation, and rollback. A detached two-repository fixture selected two different versions through one dispatcher.

Verification

• python3 .github/scripts/release_notes.py validate --repo .
• python3 -m unittest discover -s .github/tests -p "test_*.py"
• python3 .github/scripts/run_go_tests.py (153 tests, 10 isolated shards)
• go test -race ./...
• go vet ./...
• go build ./...
• git diff --check

Release note: release-notes/2026-08-11-repository-runtime-selection.md.

Runtime garbage collection remains outside this change and must prove that no repository pin references an artifact before removal.