[wangtsiao]

Summary

Moves shell execution to the host through the trusted kernel bridge and removes the kernel-side fence and credential-grant channel. Alongside that redesign, this hardens session journal persistence, locking and deletion, fixes the installer runtime cache lock, and migrates the user guide.

Key changes:

• Remove kernel_fence, credential_unix, grants.py, Windows credential delivery, and the kernel-process sandbox e2e test.
• Add host-side bash (host_bash, local_bash) and the server kernel-host shell bridge.
• Harden session persistence, file locking, deletion, journal paths, and subagent resume paths.
• Fix the installer runtime cache lock to fail closed and release only its own pid token.
• Rename docs/usage.md to docs/user-guide.md and update all README links.

Scope

228 files changed, +12603 / -6472.

Validation

Run on the exact content of this commit (clean worktree, HEAD = 0829d7248089deb119565b0ff0cfdaa1c1188614):

• cargo fmt --all -- --check PASS
• cargo clippy --locked --workspace --all-targets -- -D warnings PASS
• cargo test --locked --workspace --no-fail-fast PASS, zero failed targets (server lib 521 passed / 0 failed / 2 ignored)
• bun test scripts/runtime/packs.test.ts 3/3 PASS
• sh -n install.sh PASS

CI has not been run on this branch yet.

Known limits and notes

• CI config intentionally unchanged. .github/workflows/ci.yml still runs cargo test -p devo-kernel credential_unix::tests, but this PR removes credential_unix. That step matches zero tests and does not validate the replacement session::credential_env_tests or protocol::tests. This is a known coverage gap left by the explicit no-CI-edit requirement; a follow-up should retarget those filters.
• .github/workflows/benchmark-cli.yml still has the old step name "Verify detached Linux kernel fence". Cosmetic only.
• Windows-specific code paths are compile-checked; runtime behavior is covered by CI, not by the local validation above (run on macOS).
• docs/usage.md is renamed to docs/user-guide.md (88% similarity) rather than deleted outright.
• Overlap with fix(provider): propagate OpenAI Responses stream failures #254: the install.sh / scripts/runtime runtime-lock fix duplicates fix(provider): propagate OpenAI Responses stream failures #254 commit a0478335, docs/usage.md collides with fix(provider): propagate OpenAI Responses stream failures #254's edits, and fix(provider): propagate OpenAI Responses stream failures #254's Windows ZIP work also touches scripts/runtime/packs.test.ts. If fix(provider): propagate OpenAI Responses stream failures #254 remains blocked, merge this PR first and rebase fix(provider): propagate OpenAI Responses stream failures #254 afterwards; resolve the ZIP/test overlap during that rebase, not here.

Merge policy

Do not merge until checks on this exact HEAD are green and the scope has been reviewed.