feat(cli): add direct-hosted private candidate

[tomdps]

Closes #884

Scope

• add a build-time-only private hosted command tree that remains excluded from the stable zeroshot CLI and public npm package
• persist only nonsecret target setup metadata for one lowercase owner/name repository with provider=codex and modelLevel=level2
• orchestrate the single-worker OECP plan/apply/watch/get lifecycle through provider.hosted-direct@1 and isolation.prepared-worktree@1
• use server-provisioned fixed repository, provider, and model selectors; the CLI performs no credential acquisition, upload, installation, or keyring access
• retain unpublished candidate provenance and the hard no-publish guard

Private command surface

• target add|login|list|setup|remove
• capsule create|terminate
• run --graph <graph.json> --input <input.json> --target <name> [-d]
• remote list, status, and stop

Final unpublished candidate

Built locally from final head f38f21bee7f1fa12358d16e3c12fe37d8e6bfd42; no artifact was uploaded or published.

• marker: ZEROSHOT_PRIVATE_HOSTED_CLI_CANDIDATE_DO_NOT_PUBLISH
• tarball SHA-256: sha256:96702c04c53ff714ed66833c058ed4b57f144f2d79dcf0371cb7897a5a89a7d7
• provenance-file SHA-256: sha256:244cbd6ef65bb0425543994661af599ee4a5b3a35b05aaafb1ab35225420db43
• command-manifest SHA-256: sha256:fe1de60e108e856e41009af2c1fc2b3337c92c3dfd59ff4ec38aad701253c426
• runtime image-input SHA-256: sha256:957871f456494612d32de62c15749abf0b1603b778a45f99a5236094a566e43b
• runtime build-manifest SHA-256: 95205734fd7d8739c6c5d409881fe11296c38e0cc89fdc9f1ea5e46da67fb034
• frozen Zero Cloud [FEATURE] Cluster presets #44 fixture SHA-256: sha256:6636d50cd60067241a50d1ee027d86fc1738aa933f086d8bb2c496c5be31b85e
• Zero Cloud contract commit: a894971f0d081c4cd9e93e177bd2306bd6fe746a
• rebased main commit: e1abe6d80f8abf6d8b7e6f5c6360ff817f1c8d10

Verification

• private parser/setup/orchestration/security/package suite: 42/42 passed
• candidate builder and real dual-pack/install isolation smoke passed
• hosted target + target suites passed
• hosted-session reconnect suite: 12/12 passed
• hosted OECP Rust suite: 47/47 passed
• focused hosted Node runtime suite: 21/21 passed
• hosted image manifest check passed
• secret/obsolete-design scans found direct credential names only in explicit negative tests
• final GitHub check, Linux/macOS install matrix, CodeQL, semantic, and release-preflight checks passed

Fixed cloud integration contract

This is a handoff contract, not deployment authorization. A future cloud owner must bind one fixed private repository and one exact base revision, provider=codex, model_level=level2, provider.hosted-direct@1, and isolation.prepared-worktree@1. One AWS Secrets Manager JSON value must contain exactly GH_TOKEN and OPENAI_API_KEY and be injected only into the OECP task definition/container. The CLI cannot read, store, log, serialize, or send either value.

CTO-owned remaining work

1. Security-review the direct worker-visible secret boundary and reconcile the stale sealed-install text in [EPIC] feat(cli): deliver private hosted MVP without public release #837, feat(cli): compose the private hosted command tree and candidate #884, feat(hosted): port the hardened single-worker capsule runtime #888, zero-cloud#1, and zero-cloud#24.
2. Recover and split any useful CI/IaC work from closed, unmerged zero-cloud#67; its feat/direct-hosted-oecp branch remains retained.
3. Select and provision bounded repository/base selectors and credentials.
4. Deploy only through the existing OIDC workflow.
5. If desired, certify real Fargate/private-Git delivery end to end.

The stable CLI remains hosted-free. No Zero Cloud deployment, credential provisioning, live canary, npm publication, tag, release, or product launch occurred. Public cutover #923 remains a separate prohibited decision.

Draft status

Direct-hosted private candidate ready for cloud integration. Keep this PR draft until the CTO/cloud owner accepts the handoff; do not describe it as hosted MVP completion.

[tomdps]

Superseded by the merged stable target/session surfaces and Zero Cloud PR #67's direct hosted OECP integration. This private candidate packaging and sealed-install design are not part of the hosted MVP path.