merge: reconcile published native prerequisite and current master

Preserve canonical startup ownership, scoped evidence, current Storybook IDs, and the Codex form controls while carrying Claude effort and immutable source bindings.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/paperclip-runner/scripts/stage-release-runner-binaries.mjs

@@ -1,4 +1,3 @@
-// Assemble the four independently built release daemons before npm packing.
 // Usage: node packages/paperclip-runner/scripts/stage-release-runner-binaries.mjs MANIFEST.json
 // Manifest: {sourceRevision, platforms: {"darwin-arm64": {path, sha256}, ...}, remoteProviderPack: {path, sha256}}.
 import { createHash } from "node:crypto";
@@ -31,8 +30,6 @@ function regularFile(path, maximumSize) {
   return readFileSync(path);
 }
 
-// Production TypeScript contracts are built by the existing producer step.
-// Foreign artifacts are data: the assembler never executes another target.
 async function metadataContract() {
   const { PAPERCLIP_RUNNER_BUILD_METADATA } = await import("../dist/evals/build-metadata.js");
   const { parsePaperclipRunnerdBuildMetadata } = await import("../dist/evals/runnerd-artifact.js");
@@ -112,16 +109,12 @@ async function main() {
     if (packBytes.length > 512 * 1024 || "sha256:" + createHash("sha256").update(packBytes).digest("hex") !== entry.sha256) throw Error("Remote provider-pack release manifest digest mismatch");
     packIdentity = verifyReleaseProviderPack(JSON.parse(packBytes), manifest.sourceRevision);
   } else if (daemonOnly) {
-    // Preserve a qualified same-source Linux pack already materialized by the
-    // normal producer. It never becomes a Mac provider-pack qualification.
     packIdentity = existingReleaseProviderPack(root, manifest.sourceRevision);
   }
   const platforms = {};
   for (const artifact of verified) {
     const relative = `${artifact.target}/paperclip-runnerd`, destination = join(root, "dist", "bin", relative);
     mkdirSync(dirname(destination), { recursive: true }); copyFileSync(artifact.source, destination); chmodSync(destination, 0o755);
-    // Copied Mach-O inodes need a fresh ad-hoc signature on macOS. Record the
-    // resulting packaged bytes, as well as the verified build artifact identity.
     if (process.platform === "darwin" && artifact.target.startsWith("darwin-")) {
       execFileSync("codesign", ["--force", "--sign", "-", destination], { stdio: "pipe", timeout: 30_000 });
     }
@@ -131,7 +124,6 @@ async function main() {
   if (packBytes) {
     const destination = join(root, "dist", "remote-provider-packs", "linux-x64", "provider-pack.json");
     mkdirSync(dirname(destination), { recursive: true });
-    // Replace the inode so repeat assembly can preserve a read-only manifest.
     const staged = `${destination}.staging-${process.pid}`;
     try {
       writeFileSync(staged, packBytes, { mode: 0o444, flag: "wx" });

packages/paperclip-runner/scripts/stage-runner-binary.mjs

@@ -32,8 +32,6 @@ export async function stageBuiltRunnerBinary(packageRoot) {
   const executable = process.platform === "win32" ? "paperclip-runnerd.exe" : "paperclip-runnerd";
   const source = path.join(packageRoot, "runner", "target", "release", executable);
   const binaryRoot = path.join(packageRoot, "dist", "bin");
-  // Source builds are separate from the source-bound release targets and their
-  // manifest. The dev supervisor selects this fresh output for its server.
   await stageRunnerBinary(source, path.join(binaryRoot, executable));
 }
 

packages/paperclip-runner/scripts/stage-runner-binary.test.mjs

@@ -140,8 +140,6 @@ test("a source rebuild selects fresh dev bytes while preserving release binaries
     const copyHostFixture = async (input, output) => {
       await copyFile(input, output);
       if (process.platform === "darwin") {
-        // System fixtures can be universal; Cargo release daemons are thin.
-        // Extract only this host slice before exercising the native header gate.
         const slices = execFileSync("/usr/bin/lipo", ["-archs", input], { encoding: "utf8" }).trim().split(/\s+/);
         const architecture = slices.find(value => process.arch === "arm64" ? value.startsWith("arm64") : value === "x86_64");
         assert.ok(architecture);