feat(lume): qualify macOS backend against deployed service

[jmgilman]

Change

Integrate the Phase 8 seed and Lume backend on v0.1.1, preserving its named bearer authentication and authenticated loopback reverse-proxy fixes. Supersedes draft #31 and includes the seed work from #29; #29 is left open for its existing review.

Live qualification found and fixed three defects:

• Negotiate SSH host-key algorithms from verified known-host pins. Studio offered ECDSA while the deployed file pinned Ed25519; verification correctly rejected the unpinned key.
• Do not PATCH an unchanged Lume disk size. Lume 0.5.3 rejects equal size as a shrink; CPU/memory updates and disk growth remain supported.
• Run host scripts explicitly under /bin/sh. Studio's zsh login shell rejected an empty sidecar glob after the last sandbox was deleted.

Each failure was reproduced in a regression before its fix. No methods were added to compute.Backend.

Live acceptance

Executed against the real HTTPS MCP service on agentcompute01, from its existing source-pinned identity to Studio. Final complete MCP acceptance used source 4f7024d / version 0.1.1-phase8.4f7024d.

• Mac sandbox and Running guest; sw_vers reports macOS 26.6.2 / 25G83.
• Driver list_apps; 1920×1200 screenshot fetched over HTTPS from the agent workstation and visually checked: desktop, not Setup Assistant. No TCC approval or wizard interaction was needed.
• Snapshot create/restore recovers a file from after to before.
• Two guests Running, with seed-pinned machine identifiers and distinct MACs; third rejected with the owner's shared-budget message. Regression coverage verifies rejection before Lume HTTP calls.
• net.create returns capability failed: unsupported on platform mac.
• Server restart rediscovers both live guests. Explicit deletion leaves only the stopped seed and an empty sandbox list.
• A separate running TTL guest survives restart and is observed absent 17.61 seconds after expiry.
• Final live backend lane passes in 74.58 seconds.

Final MCP timings: first create 37.46 s, second create 51.05 s, screenshot plus HTTPS fetch 4.74 s. Earlier creates took 80–98 s; these are observations, not cold-start guarantees.

Evidence: spikes/lume/qualification.json; operational details: images/macos/README.md.

Validation

• golangci-lint fmt
• golangci-lint run — 0 issues
• go test -race ./... — pass
• go build ./... — pass
• Linux/amd64 service and live-test cross-builds with CGO_ENABLED=0 — pass
• Real authorized-source live lane and deployed MCP scenarios above — pass

Operational state and findings

Qualification used a runtime-only systemd override. The fleet-pinned v0.1.1 service, original config, and original catalog are restored; temporary binaries and the copied guest credential are removed. The restored endpoint still requires bearer authentication (401 without it). Only the stopped seed remains.

No Mac permissions, SSH policy, TCC grants, seed contents, PF rules, tailnet policy, design documents, or journal files were changed. Networking #22 and Phase 9a's same-key wrong-source refusal are established prerequisites; Studio remains untagged. The approved unrestricted Incus credential exception is unchanged.

Residuals:

• Existing concurrent-listing race: sandbox.list can return a transient not-found error if another process deletes a listed sandbox before detail lookup. Observed during parallel live-lane teardown; sequential lifecycle and TTL acceptance passed.
• PF was deliberately not applied. Wildcard VNC listener exposure remains an operator rollout prerequisite.
• Previously recorded Driver cold-boot/duplicate-launcher finding remains; qualification did not alter the seed.

This qualifies the backend; it does not permanently deploy an unreleased build or merge the pending PRs.

[jmgilman]

Seed PR #29 is now squash-merged. Rebased this branch onto that merge, dropping the already-integrated seed commits. Fixed CI goconst findings by extracting shared OS/user/state constants; behavior is unchanged. Linux/amd64-targeted lint reports 0 issues, and the rebased full race suite plus build pass. Waiting for the updated required CI before squash merge.