fix: preserve release artifacts during dev builds and display imported policy

Keep source-built daemons separate from source-bound release targets and select
fresh compatible source output only inside the development supervisor. Preserve
release manifests, running executable inodes, and explicit operator overrides.

Show the existing translated Codex permission policy in import controls while
preserving runner-only override payloads. Record real Apple Silicon task and
paused import proof alongside exact qualification sources.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/dev-runner-native-binary.test.ts

@@ -5,6 +5,7 @@ import { afterEach, describe, expect, it } from "vitest";
 
 import {
   paperclipRunnerBinaryNeedsBuild,
+  resolveNativeRunnerDevBinary,
   resolveNativeRunnerRequirement,
 } from "../../../scripts/dev-runner-native-binary.mjs";
 
@@ -36,10 +37,24 @@ function createRunnerCheckout(): { root: string; source: string; binary: string
   fs.writeFileSync(path.join(runnerRoot, "Cargo.toml"), "[workspace]\n", "utf8");
   fs.writeFileSync(path.join(runnerRoot, "Cargo.lock"), "", "utf8");
   fs.writeFileSync(source, "fn main() {}\n", "utf8");
-  fs.writeFileSync(binary, "runnerd", "utf8");
+  fs.writeFileSync(binary, nativeHeader(process.platform, process.arch));
   return { root, source, binary };
 }
 
+function nativeHeader(platform: string, architecture: string): Buffer {
+  const bytes = Buffer.alloc(128);
+  if (platform === "darwin") {
+    bytes.writeUInt32LE(0xfeedfacf);
+    bytes.writeUInt32LE(architecture === "x64" ? 0x01000007 : 0x0100000c, 4);
+  } else if (platform === "win32") {
+    bytes.set([0x4d, 0x5a]); bytes.writeUInt32LE(64, 60);
+    bytes.writeUInt32LE(0x00004550, 64); bytes.writeUInt16LE(architecture === "x64" ? 0x8664 : 0xaa64, 68);
+  } else {
+    bytes.set([0x7f, 0x45, 0x4c, 0x46, 2, 1]); bytes.writeUInt16LE(architecture === "x64" ? 62 : 183, 18);
+  }
+  return bytes;
+}
+
 describe("paperclip runner native dev prerequisite", () => {
   it("uses an explicit status response and fails safe when status is unknown", () => {
     expect(
@@ -114,12 +129,18 @@ describe("paperclip runner native dev prerequisite", () => {
     const checkout = createRunnerCheckout();
     const target = path.join(path.dirname(checkout.binary), `darwin-${architecture}`, "paperclip-runnerd");
     fs.mkdirSync(path.dirname(target), { recursive: true });
-    fs.writeFileSync(target, "target-runnerd");
+    fs.writeFileSync(target, nativeHeader("darwin", architecture));
     const old = new Date(Date.now() - 2000), current = new Date(Date.now() + 2000);
     fs.utimesSync(checkout.binary, old, old);
     fs.utimesSync(target, current, current);
     const input = { repoRoot: checkout.root, nativeRunnerRequired: true, platform: "darwin", architecture };
     expect(paperclipRunnerBinaryNeedsBuild(input)).toBe(false);
+    // A newer Linux build-host output cannot mask the remote Mac artifact.
+    fs.writeFileSync(checkout.binary, nativeHeader("linux", "x64"));
+    const wrongHostNewer = new Date(Date.now() + 4000);
+    fs.utimesSync(checkout.binary, wrongHostNewer, wrongHostNewer);
+    expect(resolveNativeRunnerDevBinary(input)).toEqual({ binary: target, sourceBuild: false });
+    expect(paperclipRunnerBinaryNeedsBuild(input)).toBe(false);
     fs.rmSync(checkout.binary);
     expect(paperclipRunnerBinaryNeedsBuild(input)).toBe(false);
     fs.utimesSync(target, old, old);
@@ -128,6 +149,26 @@ describe("paperclip runner native dev prerequisite", () => {
     expect(paperclipRunnerBinaryNeedsBuild(input)).toBe(true);
   });
 
+  it.each(["arm64", "x64"])("uses only a newer matching Mac %s source build without changing release selection", architecture => {
+    const checkout = createRunnerCheckout();
+    const target = path.join(path.dirname(checkout.binary), `darwin-${architecture}`, "paperclip-runnerd");
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, nativeHeader("darwin", architecture));
+    fs.writeFileSync(checkout.binary, nativeHeader("darwin", architecture));
+    const old = new Date(Date.now() - 2000), fresh = new Date(Date.now() + 2000), changed = new Date(Date.now() + 4000);
+    fs.utimesSync(target, old, old); fs.utimesSync(checkout.binary, fresh, fresh);
+    const input = { repoRoot: checkout.root, nativeRunnerRequired: true, platform: "darwin", architecture };
+    expect(resolveNativeRunnerDevBinary(input)).toEqual({ binary: checkout.binary, sourceBuild: true });
+    expect(paperclipRunnerBinaryNeedsBuild(input)).toBe(false);
+    fs.utimesSync(checkout.source, changed, changed);
+    expect(paperclipRunnerBinaryNeedsBuild(input)).toBe(true);
+    fs.writeFileSync(checkout.binary, nativeHeader("darwin", architecture === "x64" ? "arm64" : "x64"));
+    expect(resolveNativeRunnerDevBinary(input)).toEqual({ binary: target, sourceBuild: false });
+    fs.rmSync(target);
+    expect(resolveNativeRunnerDevBinary(input)).toBeNull();
+    expect(paperclipRunnerBinaryNeedsBuild(input)).toBe(true);
+  });
+
   it("does not build a workspace binary when an explicit binary is configured", () => {
     expect(
       paperclipRunnerBinaryNeedsBuild({