Run bounded test and build commands in task worktrees - #10672

Held in draft until the prerequisite features land, following maintainer review. The implementation and composed validation are prepared; after the foundation PRs merge, this branch should rebase directly onto their real mainline code before final review. The task engine is now included with its first consumer in #10658, rather than landing separately through #10655.

Project task implementers can now run tests and builds in their own worktrees when the user explicitly enables commands. Each attempt has six durable command reservations, a 120-second execution limit per command, and 64 KiB of captured output. Implementers can repair a failing check, reread the changed file and rerun the identical command within that allowance. The model receives a 4,096-character output preview with command ID and truncation metadata; the evidence endpoint retains the full bounded capture. The task panel shows command outcomes and bounded output separately from the model's final response, including after cancellation or failure.

This is an independent source layer over #10633 (lifecycle), #10577 (secure edits), #10594 (owned Git worktrees), #10658 (task engine and execution/UI), and #10636 (command supervision). CI composes exact prerequisite revisions listed in studio/docs/project-task-commands.md. The existing task and supervisor PRs carry optional entry points and UI support; the Git PR exposes its existing owned-path proof to trusted callers already holding the project execution fence.

Commands require a live private task worker, an implementer role and captured opt-in. Model arguments contain only argv and timeout. Worktree ownership, inode, Git registration and runtime are checked before dispatch and again before physical spawn/release. Linux bubblewrap masks the checkout's root .git file with a read-only empty mount, confines writes to the assigned checkout, excludes primary project files and host secrets, and disables network access. Dependencies must already be available in the restricted runtime. macOS and Windows refuse command execution.

The supervisor retains its workspace lease, mutation slot and monitor-held process fence through quarantine. Existing Git operations and project retirement require that same fence. Unconfirmed process cleanup cancels further task tools; interrupted or unconfirmed command evidence is never labeled as passing. No automatic commit, merge, worktree cleanup or live-model quality/performance claim is included.

Validation:

• The composed backend covers command/task/runtime/ownership, shared tool loop/controller, Git, lifecycle, secure editing and process-supervision suites. A simulated model through the actual tool loop reads a file, observes a failed check, edits expected content, rereads the change and reruns the same check successfully; the primary file remains unchanged.
• Standalone missing-prerequisite gate: one test passed; missing support is reported without runtime startup.
• Nine frontend API/control tests, app/test type checks, production build and bundle budget pass. The composed startup bundle remains within the existing budget (82 eager chunks).
• Browser fixture verified default-off opt-in, submitted opt-in, pass/fail/timeout/unconfirmed-cleanup labels, full captured output and unsupported-host controls. Fixture responses are simulated.
• Ruff, repository formatter, diff checks and 119 workflow-policy regressions pass.

Exact head 0acbedb4761995bb6d5de568def92cb4962d33e4 passed all four jobs in native command integration CI: Linux 411 passed/11 platform skips, macOS 398 passed/24 platform skips, Windows 307 passed/115 platform skips, and frontend nine tests, typecheck, build and bundle budget passed. The early gate now explicitly selects only the missing-prerequisite test (one passed on each host), so native execution never precedes Linux isolation setup.

Both workflow composition blocks reuse pinned commit objects already present and fetch only missing objects. The actual backend and frontend blocks also passed locally with a Git wrapper that rejects every fetch, and the early gate passed after all prerequisites were installed. Six output-heavy commands verify 4,096-character model previews while preserving each full 64 KiB capture through the evidence API. The final composition also includes delayed cooperative cleanup and explicit timeout regressions from #10658.

Upstream hosted checks and maintainer review remain separate merge gates; no merge is implied.