serve diagnostics during managed provisioning

[TheGreenCedar]

Context

Fresh managed-plugin startup awaited the full CLI download, extraction, verification, and publication path before opening MCP. A slow publisher or another process holding the single-flight lock therefore made CodeStory invisible instead of exposing its existing diagnostic surface.

Closes #1022
Refs #921

What Changed

• Open diagnostic MCP immediately when no verified exact-version managed CLI is installed.
• Run the existing fail-closed publisher in the background with asynchronous lock-wait polling; archive checksums, binary checksums, exact version, stdio initialize proof, quarantine, and atomic publication are unchanged.
• Report managed_cli_provisioning, advertise tools/resources/prompts list-change support, and notify the client only after it has completed MCP initialization and publication is verified.
• Replay initialize and notifications/initialized into the real stdio runtime before forwarding operational traffic, suppressing only the duplicate child initialize response.
• Forward host EOF and recover spawn/nonzero child failures back into readable diagnostic status without duplicate JSON-RPC responses.
• Make packaged acceptance exercise the real MCP initialization lifecycle and wait for advertised tools/list_changed publication before asserting the verified runtime status.
• Harden packaged-proof response correlation, protocol-envelope validation, failure artifacts, and numeric JSON-RPC ID preservation.
• Document the no-restart managed startup flow.

How To Review

1. Inspect resolveCli({ provision: false }) and the deferred publisher in main.
2. Inspect async lock acquisition and confirm it reuses the existing ownership/reclaim primitive.
3. Inspect runFailOpenMcp lifecycle replay, list-change gating, EOF forwarding, and failure recovery.
4. Review the delayed publisher, contended waiter, lifecycle-enforcing child, buffered-response/nonzero-exit, and spawn-error tests.
5. Review .github/scripts/check-packaged-agent-proof.py initialization, publication notification wait, correlated reply validation, and negative protocol fixtures.

Verification

• python -m py_compile .github/scripts/check-packaged-agent-proof.py
• python .github/scripts/check-packaged-agent-proof.py --self-test — passed, including managed handoff, list-change publication, malformed protocol, failure-artifact, and numeric-ID cases
• node --test plugins/codestory/tests/plugin-static.test.mjs — 72 passed
• node --check plugins/codestory/scripts/codestory-mcp.cjs
• node .github/scripts/check-doc-links.mjs — 69 files, 281 links
• git diff --check origin/dev/codestory-next...HEAD
• Independent source review: clean after contention, lifecycle, EOF, terminal failure, stdout-drain, protocol-correlation, and numeric-ID fixes

The first packaged CI run exposed a proof-harness mismatch rather than a launcher failure: Linux and Windows x64 captured the intentional initial managed_cli_provisioning diagnostic (server_version: null) because the harness sent operational requests without MCP initialize / notifications/initialized and did not wait for the advertised list-change handoff. Direct packaged CLI status was healthy. The harness now follows the negotiated lifecycle and asserts the verified post-publication runtime in the same process. Fresh packaged CI is rerunning on this fix.

Risk

The runtime change is limited to the Node plugin launcher and its tests/docs; no Rust or release asset format changes. The additional Python diff corrects packaged acceptance so it proves the new two-phase startup contract. Remaining qualification is the fresh cross-platform packaged CI run. Screenshot evidence is not applicable because this changes MCP startup protocol behavior, not visible UI.