♻️ feat: Reuse Verified Environment Preparation

[danny-avila]

Summary

Repeated worker starts currently rerun environment setup even when a checkout's dependencies have not changed. For installation recipes this wastes time and makes restart recovery perform unnecessary writes.

Add opt-in setup.reuse with explicit input files and a sandboxed readiness check. Existing definitions still run setup on every startup. Matching preparation evidence now checks readiness instead of reinstalling; changed inputs or missing artifacts run setup again.

Mechanism

declared inputs + recipe + checkout identity + runtime/policy
                         ↓ fingerprint
matching private receipt → readiness check → reuse
missing/stale receipt    → setup → readiness check → atomic receipt

Receipts are owner-only worker state outside registered roots and denied to native commands. Hashing uses held root descriptors and bounded regular-file reads. Inputs must remain unchanged through setup and readiness. Cancellation, uncertain termination, timeout and failure cannot publish success. Startup retains the existing mutation guard; fresh conversation instances use the same contract.

This is the first slice of a resource-lifecycle stack. It does not share installed dependencies between worktrees, prepare linked lanes on command admission, alter sandbox grants, add disk quotas or modify a live deployment. Those need separate reviewable changes. The README documents the contract, example configuration and these limits.

Verification

• Worker TypeScript build (npm run build in packages/code).
• Focused CLI, storage, environment and mount-isolation suites: 81 passed, six platform/opt-in skips before the final added receipt test.
• Final preparation suite, including a real native-SRT canary: installation reuse, missing-output repair, receipt read/write denial, changed inputs, failure/cancellation, bounded hashing and foreign-checkout receipt rejection.
• git diff --check.

No live worker restart or deployment performed. Full repository CI is left to this PR.