FE-1118: Reconcile host executor promotion

[kostandinang]

Summary

• Adds host promotion preflight and accepted apply tools for CODE mode.
• Applies promoted run patches to host files only; no commit/ref/index staging.

Verification

• npm run verify

[cursor]

PR Summary

High Risk
Introduces deliberate host worktree mutation via git apply; mitigated by preflight-only default, explicit commit acceptance, apply --check, and tests that HEAD/index stay unchanged.

Overview
Adds FE-1118 host executor promotion: after run-local promotion_prepared, CODE mode can inspect the promoted diff on the host and optionally apply it to host worktree files only.

Executor + app: New host-promotion.js validates run.json / promotion.json, delegates diff inspection and patch apply to GitHostPromotionPort, and gates apply on acceptedCommitSha with preflight rerun and mismatch handling. createGitHostPromotionPort implements preflight via run-worktree git diffs and apply via git apply --check then git apply with patch stdin; runCommand gains optional stdin for that path. HostPromotionApplyResult no longer includes impossible preflight_ready.

Pi / policy: Registers execute_host_promotion_preflight and execute_host_promotion_apply, wires the port in default product composition, admits both in EXECUTOR_ALLOWED_TOOL_NAMES, and updates execute_status to list ported tools from that list. Memory scope cards document preflight, apply, Pi exposure, and apply hardening.

Tests: Vitest coverage for core helpers, app port (including real temp-git apply/conflict), registry/TUI tool lists, and execute-mode activation.

^{Reviewed by Cursor Bugbot for commit 4867ea0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[kostandinang]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• FE-1118: Reconcile host executor promotion #282 : 2 dependent PRs (#284 , #285 ) 👈 (View in Graphite)
• FE-1112: Reconcile run-local executor promotion #279
• FE-1111: Reconcile executor agent runner #278
• FE-1109: Reconcile executor sandbox worktrees and test runner ports #275
• FE-1089: Reconcile executor with alpha branch #274
• next

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c29af50. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c29af50. Configure here.}

[lunelson]

This host-promotion layer keeps the risky part narrow: preflight is read-only, apply requires the accepted SHA, and host changes are file-only with no commit/ref/index mutation.

One thing I noticed is that this PR also admits the full execute_* lifecycle in active-tools.ts, while memory/SPEC.md in this PR still describes the lifecycle tools as inactive until the stack lands. I’m okay with that because #284 appears to be the stack-closing doc sync that retires that language and makes the active lifecycle explicit. If #282 ever lands without #284, that invariant text should be updated here.

[kostandinang]

Merge activity

• Jul 3, 5:42 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 3, 5:42 PM UTC: Graphite couldn't add this pull request to the GitHub merge queue because a downstack PR FE-1089: Reconcile executor with alpha branch #274 failed to merge.