[AXTRACK]

Why
The first runtime implementation incorrectly treated normal long-lived stdio MCP servers as successful only when the process exited after initialize, and deterministic CI did not execute the runtime harness.

Change

• wait for the matching JSON-RPC initialize response instead of waiting for server process exit
• send notifications/initialized, then terminate the disposable target process tree from the harness
• preserve bounded stdout/stderr capture and output-limit stop semantics
• derive the scrubbed target PATH from trusted Git/Node/npm tool locations so hosted-runner Node remains reachable
• explicitly restrict the trusted checkout from the target account
• make safe/noisy fixtures model a persistent MCP server
• add controlled runtime fixture CI covering lifecycle, cleanup, filesystem/process/network observations, timeout behavior, and trusted-checkout isolation

Non-goals
No new adapter, no broader network mode, no credentials, no security verdict logic, no self-hosted runner, and no stronger malware-analysis claim.

Validation
The replacement harness was Python-compiled and its persistent initialize session was exercised in an isolated local root/container check. GitHub CI on this PR is the authoritative validation for the hosted-runner behavior and controlled fixtures.