feat(runner): add remote execution substrate (#12638)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Paperclip Runner gives native runs a durable and governed execution
path.
> - The current native path runs on the control-plane host.
> - Remote environments need an authenticated execution-target contract.
> - The contract must not change direct adapters or enable new runtimes
by default.
> - This pull request adds the remote execution substrate and Daytona
ingress.
> - The benefit is a bounded base for later remote runner transport
work.

## Linked Issues or Issue Description

Refs #12616.
Refs #12352.

**Subsystem affected**

Cross-cutting. This change touches runner transport, server
orchestration, plugin contracts, and shared settings.

**Problem or motivation**

Native execution cannot resolve an authenticated runner ingress through
a remote environment. The server also lacks one provider-neutral
contract for remote execution targets.

**Proposed solution**

Add a default-off runner preview ingress capability. Add
transport-neutral runner connectivity. Add remote execution target and
lifecycle handling. Add a Daytona ingress implementation with redacted
credentials.

**Alternatives considered**

A provider-specific server path would duplicate orchestration and
authorization. A public endpoint without an environment contract would
weaken the trust boundary.

**Roadmap alignment**

This work supports the Cloud and Sandbox agents milestone. It also
supports self-healing runs and governed tool access.

## What Changed

- Added execution-target traits for local, SSH, and sandbox
environments.
- Added plugin RPC contracts for runner ingress endpoints.
- Added authenticated Daytona preview ingress.
- Added transport-neutral PRP outbound connections.
- Added remote runner artifact verification and fail-closed provider
selection.
- Added bounded native session resume, cancellation, and lifecycle
recovery.
- Preserved Codex-only selection for fresh experimental runner starts.
- Preserved all direct adapter execution and finalization paths.
- Removed stale Pi provider-pack requirements that security review
rejected.
- Kept the rollout controls off by default.
- Did not change pnpm-lock.yaml, Cargo, database migrations, or GitHub
workflows.

## Verification

- GitHub Actions will run the repository test, typecheck, build,
security, and policy gates.
- Focused tests cover ingress validation, redaction, execution targets,
remote lifecycle, cancellation, resume, and legacy adapter selection.
- Local tests were not run. The requested verification policy uses
GitHub Actions for this series.
- `git diff --check origin/master...HEAD` passes.
- The diff contains 52 files.

## Risks

- Remote execution crosses a trust boundary.
- The implementation validates target capabilities, artifact digests,
provider-pack pins, and connection metadata.
- The feature remains default-off.
- Fresh native selection remains Codex-only.
- Existing direct adapters remain on the legacy path.
- This PR does not yet make remote Codex runnable. The next PR adds the
Rust WSS and TLS transport.

## Model Used

OpenAI Codex with GPT-5.6. The work used high-reasoning agent mode,
repository tools, GitHub tools, and parallel code-audit agents.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with Fixes: / Closes /
Refs OR (b) described the issue in-PR following the relevant issue
template
- [x] I have not referenced internal or instance-local Paperclip issues
or links
- [x] My branch name describes the change and contains no internal
Paperclip ticket id
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

server/src/services/native-runtime/native-execution-input.ts

@@ -1,12 +1,18 @@
 import type {
+  NativeAcpxAgent,
+  NativeAcpxPermissionMode,
   NativeCodexApprovalPolicy,
   NativeExecutionInputV4,
   NativeInteractionResponseEnvelope,
+  NativeOpenCodePermissionMode,
   NativePlanningContext,
   NativeRuntimeContextSnapshot,
   StrictCompletionContractInput,
 } from "../../vendor/paperclip-runner/index.js";
-import { parseNativeExecutionInput } from "../../vendor/paperclip-runner/index.js";
+import {
+  parseNativeExecutionInput,
+  resolveQualifiedAcpxProfile,
+} from "../../vendor/paperclip-runner/index.js";
 import { renderPaperclipWakePrompt } from "@paperclipai/adapter-utils/server-utils";
 
 /** Closed constructor: callers cannot spread legacy context or environment data. */
@@ -38,7 +44,11 @@ export function buildNativeExecutionInput(input: {
     branchName: string | null;
   };
   normalizedSessionId: string | null;
+  provider?: "codex" | "opencode" | "acpx";
+  acpxAgent?: NativeAcpxAgent;
   codexApprovalPolicy?: NativeCodexApprovalPolicy;
+  opencodePermissionMode?: NativeOpenCodePermissionMode;
+  acpxPermissionMode?: NativeAcpxPermissionMode;
   model?: string | null;
   lifecyclePolicy?: NativeExecutionInputV4["session"]["lifecyclePolicy"];
   executionMode?: "default" | "plan";
@@ -57,6 +67,12 @@ export function buildNativeExecutionInput(input: {
   }
   const executionMode = input.executionMode
     ?? (input.issue.workMode === "planning" ? "plan" : "default");
+  const acpxProfile = input.provider === "acpx"
+    ? resolveQualifiedAcpxProfile(
+        input.acpxAgent ?? "pi",
+        input.model ?? "",
+      )
+    : null;
   const wakePrompt = renderPaperclipWakePrompt(input.wakePayload, {
     resumedSession: input.resumedSession === true,
     suppressIssueDescription: input.taskPrompt.trim().length > 0,
@@ -90,15 +106,44 @@ export function buildNativeExecutionInput(input: {
     },
     session: {
       normalizedSessionId: input.normalizedSessionId,
-      driverKind: "codex_app_server",
+      driverKind: input.provider === "opencode"
+        ? "opencode_server"
+        : input.provider === "acpx"
+          ? "acpx_runtime"
+          : "codex_app_server",
       protocolVersion: 1,
       lifecyclePolicy: input.lifecyclePolicy ?? { mode: "per_turn", idleTimeoutMs: null },
     },
-    provider: {
-      kind: "codex",
-      model: input.model ?? null,
-      approvalPolicy: input.codexApprovalPolicy ?? "never",
-    },
+    provider: input.provider === "acpx"
+      ? {
+          kind: "acpx",
+          agent: acpxProfile!.agent,
+          model: input.model,
+          permissionMode: input.acpxPermissionMode ?? "approve-all",
+          profile: {
+            driverKind: acpxProfile!.driverKind,
+            protocolVersion: acpxProfile!.protocolVersion,
+            acpxVersion: acpxProfile!.acpxVersion,
+            agent: acpxProfile!.agent,
+            agentProfileVersion: acpxProfile!.agentProfileVersion,
+            agentServerPackage: acpxProfile!.agentServerPackage,
+            agentServerVersion: acpxProfile!.agentServerVersion,
+            agentRuntimePackage: acpxProfile!.agentRuntimePackage,
+            agentRuntimeVersion: acpxProfile!.agentRuntimeVersion,
+            commandDigest: acpxProfile!.commandDigest,
+          },
+        }
+      : input.provider === "opencode"
+        ? {
+            kind: "opencode",
+            model: input.model,
+            permissionMode: input.opencodePermissionMode ?? "allow",
+          }
+        : {
+            kind: "codex",
+            model: input.model ?? null,
+            approvalPolicy: input.codexApprovalPolicy ?? "never",
+          },
     completionContract: input.completionContract,
     interactionResponses: input.interactionResponses ?? [],
     credentialBindings: [],