CONTRACT: fix(backends): use the host app exec wrapper

[schlessera]

Refs #1429

What changed

Each app passes its resolved exec wrapper through startup probes, backend construction, Claude per-turn probes and SDK workers, and Pi grep/bash tools including worker-local construction. Host A/C override ambient B. An explicit empty configuration disables the optional wrapper. Omitted standalone inputs retain the previous late ambient fallback, including an environment change after factory construction; Pi carries the current host fallback into each worker turn.

Why this shape

The existing backend context and factory options carry the host configuration, as required by #1429 and #1343. Explicit configurations are copied per backend; omission stays distinguishable from {}. Validation, argv, permissions, credential selection and worker isolation retain their behavior. The additive contract, three optional public API fields, minor changeset and moved citations are included.

Proof

Local tested head f462a8f84bbe1d296a55c1f3f45e8d8475c6ab04; local tested base 82a64a13a08c44f2daef425d1a9df2c10840ea8e. Fetched target main is now 68e12f27eb249c9fe7262a498a0397c04bbda8f4: browser weights (#2379), viewer font-floor proof (#2368), native phase composition (#2384), and private-tmp placement proof (#2389) advance its proof inputs. That newer combined tree is unqualified here. Preserved implementation f7f3b3f1d390081ac54aa52dccb4389316d86ecc; #2361's app/worker/maintenance inputs were reviewed and integrated in db37ddcb6, and #2371's five native TCP fixture changes in f462a8f84.

• Original head f7f3b3f1d / base 0d780605f: required Claude/Pi/server suites pass 4,362 tests / 28,452 assertions across 386 files, including app isolation and both provider-history guards. This receipt belongs to that original tree, not the final candidate.
• Corrected source committed in b4cf5234c: 87 focused tests / 328 assertions across six files pass actual app A/C, empty/omitted inputs, Claude probes/SDK argv, Pi grep/bash/worker init and decision citations. Explicit propagation mutation fails SDK_WORKER_HOST_ARGV; restored file passes 1 test / 22 assertions. Separate intended-red controls prove late ambient changes after construction: OMITTED_HOST_EXEC_REMAINS_LIVE and PI_WORKER_OMITTED_EXEC_REMAINS_LIVE.
• Corrected source strict typecheck passes; API-report regeneration produces no diff. Dependencies use frozen private file copies. The final merge adds only the reviewed upstream TCP test fixtures.
• Original failing-first and mutation receipts remain on backends: resolve the exec wrapper from the host's app config instead of process.env #1429: HOST_PROBE_A, HOST_WRAPPER_SELECTED, PI_WORKER_HOST_EXEC and APP_RUNTIME_PROBE_WRAPPER, in addition to the repeated SDK mutation.
• Same-class audit finds no no-argument resolveExecConfig() in either backend; all ambient edges, host propagation, worker serialization and factory omission handling were reviewed.
• Native-diagram self-test passes 1 test / 13 assertions on f7f3b3f1d. This contribution and both integrated base deltas leave its source families/pins unchanged; ci: native diagram qualification self-test rejects legitimate source drift #2365 is not an established blocker here.
• Required bun run check:pr --base origin/main completed exit 1 on the local tested head/base: lint/leakage, environment docs and changeset checks passed; fast invariants 730 pass / 36 files; import-graph feedback 3,378 pass / 2 fail / 25,774 assertions / 283 files. Both failures report native CLI exit 137: hygiene same-identity refresh and module-settings active-state HTTP 500. Tracked in P1 ci: diagnose native CLI exit 137 during hygiene and module-settings preflight #2396.
• One bounded instrumented control per failing case passes separately (hygiene 25 assertions; module settings 46). These are non-reproduction/recovery receipts, not a correction or broad-preflight pass. No failed-child termination origin or matching OOM cause was established.
• Final explicit provider-history guards on f462a8f84: 25 pass / 135 assertions across both backends, including real captured native requests.
• Complete selected current-candidate hosted proof is missing. This remains draft while ci: diagnose native CLI exit 137 during hygiene and module-settings preflight #2396 blocks verification; no ready-candidate confirmation or merge is claimed.

Historical evidence remains distinct: earlier exit-137, quota/body-restoration and cancelled/incomplete suite receipts are preserved on #1429. Continuation preflights failed on owned cancelled-run artifacts inside the tree (moved intact outside; strict leakage passed) and unsafe fixture cleanup (corrected in cd980abec). The subsequent preflight passed 730 fast invariants and real-browser scratch/viewer, share, tracker and turn-journal controls, then was deliberately stopped to correct the proven late-fallback regression. It remains incomplete. Local memory/pids/CPU cgroup limits were reported unavailable; passing native/rlimit tests do not qualify those controls.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• All acceptance and verification criteria are complete; behavior is implemented, but ci: diagnose native CLI exit 137 during hygiene and module-settings preflight #2396 and current-candidate proof remain open.
• The PR and completed/advanced issues have verified release milestones under docs/process/github.md.
• A minor changeset is included.
• Public text is screened and the strict tree leakage gate applies.
• The integration contract index and package API component are updated in CONTRACT commits.
• Moved citations and public API reports are updated.
• Final explicit provider-history guards pass on the local tested head; complete selected hosted proof remains open.

Anything left open

Blocked by #2396

Diagnose and resolve the native CLI termination failures, reconcile the newer target proof inputs, pass required preflight and complete selected current-candidate hosted proof, inspect selected jobs/checkouts, then verify milestones, matching-head merge, main ancestry, issue closure and automatic main-push proof. No behavior criterion is intentionally deferred. Per-app mutable state remains owned by #1364. A pre-existing source-comment pointer, unchanged by this contribution, is tracked separately in nonblocking #2383.