feat(lume): implement macOS backend with identity-pinned clones

[jmgilman]

Status

Backend implemented and verified locally. Phase 8 is not yet deployed or qualified. The existing agentcompute server VM was selected, but its identity/tailnet source IP is still needed to install and prove the approved SSH boundary. Keep this PR draft. Stacked on #29.

Changes

• Implement internal/lume against the existing 36-method compute.Backend; no Lume-only interface methods.
• Tunnel lifecycle HTTP to Studio loopback through SSH. Use system SSH ProxyJump for guest execution and SFTP for literal-path/binary file transfer, with distinct host and per-image guest keys.
• Persist atomic account-owned sandbox sidecars, TTL/subject metadata, instance and snapshot mappings, and recoverable cleanup ownership. Pin only machineIdentifier before first boot, preserving clone MACs.
• Gate starts using the account's lume ls inventory before Lume HTTP. Detect accepted-but-stopped host-wide Apple capacity failures using only newly appended daemon log bytes.
• Wait for the desktop and GUI launchd domain before Driver kickstart and TCC readiness. Preserve failed snapshot copies in durable ownership records until deletion succeeds.
• Add Mac platform dispatch, the Tahoe seed: catalog entry, service wiring tests, real SSH/SFTP transport fixtures, and AGENTCOMPUTE_TEST_LUME live backend lane.
• Update the runbook, changelog and spikes/lume/identity.json. Retain the earlier strict wizard regression gate, identity evidence, and unapplied PF proposal.

Verification

Passed with Go 1.26.6 on darwin/arm64:

• golangci-lint fmt --config .golangci.yml
• golangci-lint run --config .golangci.yml ./... --show-stats=false
• go test -race ./... -count=1 -timeout=180s
• go build ./...
• GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build ./...
• Compiled server offline startup: python3 .github/scripts/mcp_smoke.py --offline -- bin/agentcompute stdio
• jq empty spikes/lume/identity.json

Transport regressions use real system SSH, separate jump/guest keys and the native SFTP server; only Lume HTTP is simulated. They cover quoting, cancellation, literal globs, permissions, missing files and binary transfers. Lifecycle regressions cover pre-HTTP capacity refusal, resource preparation, and exact-name cleanup retaining failed snapshot copies.

The environment-gated live backend test was not run. These checks are not deployed MCP evidence.

Host evidence and residual

• agentcompute remains hidden, standard/non-admin; sudo -n true exits 1.
• /Users/josh is now owner-only (0700); the account cannot read or traverse code, Documents, .ssh or Library beneath it.
• The proposed root-owned source-restricted normal-shell SSH policy passed syntax/effective-config checks, but is not installed. The old forced-command policy remains active. Same-key wrong-source authentication has not been exercised.
• Earlier fresh pinned clones retained the seed UUID/serial, unique MACs, no wizard and both Driver grants; two ran concurrently after kickstart.
• A fresh disposable diagnostic clone exposed a second legacy Driver launcher. Removing it in that clone did not resolve the canonical job's scheduling/ownership behavior. Cold-boot root cause remains unresolved; the seed and TCC databases were not changed.
• Diagnostic clones were deleted; the last host inventory contained only the stopped Tahoe seed.

Remaining deployed acceptance

Blocked on the verified existing server VM identity/source IP: install and reprove SSH source containment; create through MCP and run sw_vers; list apps; retrieve a screenshot; snapshot and restore; delete to seed-only inventory; restart rediscovery and TTL cleanup; unsupported-network AgentErrors; two concurrent guests and third-guest refusal. Creation and screenshot service round-trip timings remain unmeasured.

No PF application, tailnet ACL changes, design-document edits or .journal/ edits. No prerequisite PR was merged.

Prerequisites and upstream

• feat(macos): qualify the Tahoe Lume seed and its Mac Studio host #29: open, ready for review, unmerged.
• feat(tailscale): reserve the Mac backend's SSH port for the agentcompute server networking#21: open draft, unmerged and untouched.
• VNC bind address: [RFC]: Add an explicit bind address to Lume VNC listeners trycua/cua#3878
• SSH argv flattening: [Bug]: lume ssh flattens command arguments without shell escaping trycua/cua#3879
• Silent third-VM start: [Bug]: Lume HTTP API hides a third-VM start failure behind 202 pending trycua/cua#3880

[jmgilman]

Superseded by #36, which integrates the seed and backend on v0.1.1, fixes the three live-discovered transport/lifecycle defects, and records completed authorized-source live-lane and deployed MCP acceptance. The old implementation branch is retained; #29 remains open for its existing seed review.