Wire authenticated recipe worker broker loop

[dovvnloading]

Summary

This advances Phase 2 from a qualified native launcher/binder to a real worker-side authenticated broker runtime while keeping provider lifecycle enablement fail-closed.

What changed

• Added RecipeWorkerBrokerRuntime, a broker-only worker loop that:
  • binds every message to the expected installation principal and exact job ID;
  • consumes only typed prepare, input_chunk, input_complete, cancel, and collect operations;
  • emits redacted acknowledgements, results, bounded output chunks, and stable error codes;
  • runs broker reads concurrently with provider transforms so cancellation reaches an in-flight transform;
  • enforces a bounded message budget and wall-clock watchdog;
  • closes the broker connection and provider on every terminal/failure path.
• Made RecipeWorkerSession thread-safe for concurrent cancellation and provider completion.
• Added explicit broker streaming operations while retaining legacy start only as a transport compatibility value; the fixed worker rejects it rather than guessing semantics.
• Replaced the package's unconditional refusal entrypoint with the fixed native launch contract: protected pipe, broker PID, installation principal, and job ID. Direct/malformed/failed launches still return exit 78 and never fall back to stdio, shell, paths, or host-process execution.
• Extended the launcher command line and PyInstaller hidden imports for the worker runtime.
• Added hostile runtime coverage for malformed-body repair, identity confusion, provider failure redaction, in-flight cancellation, watchdog timeout, message budgets, cleanup, and fixed-entrypoint parsing.
• Updated the broker, worker, launcher, sandbox, parent ADRs, evidence log, packaging notes, and qualification probes so the documented gates match the implementation.

Safety and release boundary

This PR does not enable the production execution lifecycle or UI route. The generated Windows package is intentionally unsigned and is not launch-authorized by source control. The remaining release gate is an externally signed and pinned worker generation installed through SignedBundleInstaller, followed by a real suspended AppContainer/Job Object launch, authenticated broker handshake against the actual PID/AppContainer token, hostile decoder corpus, watchdog/accounting evidence, artifact-boundary publication evidence, and external security review.

Validation

• Python: 251 passed, 1 skipped with one pre-existing pytest-asyncio deprecation warning.
• Worker runtime: 9 dedicated tests, including cancellation during an active transform and watchdog expiry.
• Ruff targeted checks: passed.
• python -m compileall -q backend\\cortex_backend\\execution tests: passed.
• python tools/generate_contracts.py: passed.
• git diff --check: passed.
• Frontend lint, typecheck, production build, and all 39 frontend tests: passed.
• Windows PyInstaller package build: passed; dist/recipe-runtime/recipe_worker.exe direct launch returned exit 78.
• Native qualification: Job Object/AppContainer controls passed; the overall qualification remains intentionally blocked at the signed-worker/PID-token gate (recipe_sandbox_qualification.py --strict exit 2).

Review focus

Please review the worker concurrency/cancellation state transitions, watchdog close behavior, broker envelope identity binding, package argument parsing, and the explicit distinction between qualification evidence and production authorization.

[dovvnloading]

Validation complete

Quality passed on this branch (run 30036865775 / job 89306894273, 3m07s): headless tests, compile, generated-contract verification, frontend typecheck/lint/unit tests/build, one-folder Windows package build, and launcher-managed bundle verification.

Local evidence also passed: 251 Python tests with one platform skip, targeted Ruff, compileall, contract generation, diff check, package direct-launch refusal (exit 78), and native qualification controls. The qualification remains intentionally blocked only because this PR does not ship or install an externally signed worker generation; that gate still requires the signed manifest/trust root, real suspended worker PID/AppContainer broker handshake, hostile in-sandbox corpus, watchdog/accounting evidence, artifact publication evidence, and external review. Provider lifecycle/UI remain disabled.