feat: install and connect self-hosted Sessions with one command

[SaladDay]

Self-hosted Session creation and detail responses now return an Environment-specific installation command in x_agents_core.installation. Core Web displays that command in the Self-hosted Session. API callers can complete onboarding without Web or a Core key.

The command downloads the native bundle matching the Core revision and Runtime protocol, uses the existing installer to select and install Harnesses, starts the existing daemon and verifies its authenticated connection. Interactive and noninteractive modes share the same implementation. The Session workspace stays fixed; users can choose the installation directory and additional supported Harnesses.

Authorization expires after 30 minutes and can claim one Environment credential. The installer saves its generated secret before claiming it, so a lost response is recoverable. Long-lived credentials stay out of command arguments and output. Repeated installation reuses compatible components, preserves workspace/history and avoids a second daemon.

Supported distributions: Linux amd64, macOS arm64 and Windows amd64. Codex and Claude Code are available on all three; MiniMax Code remains Unix-only. Installation runs with the user's existing permissions. Model configuration, upgrades, auto-update and execution isolation are outside this change. Installation, daemon connection and model readiness are reported separately.

Validation:

• Native macOS execution on the local Mac with Codex; compilation ran remotely. No model requests were made.
• Linux execution of the full command generated by Core, including bootstrap script download, against an authenticated transport fixture, plus PostgreSQL-backed API/store tests for expiry, concurrent claims, revocation and retry.
• Native CI exercises interactive bootstrap, noninteractive errors, rejected authorization, recovery from a lost claim response, automatic connection and repeated installation without duplicate daemons.
• Client parsing tests, Web typecheck and focused Session browser acceptance passed; generated API references and installation guides updated.
• The remaining example application checks passed remotely, including 10 browser cases using the host’s existing Chromium; MiniMax checks passed (7 passed, 4 skipped).
• Independent blind review completed; release artifact staging and reusable-workflow concurrency findings fixed.

The connection checks validate installation and authenticated transport, not model/provider execution. Core deployments need the matching native artifact catalog; missing distributions are reported explicitly. Native CI: https://github.com/MiniMax-AI/parsar-core/actions/runs/36545481420 (all three platforms passed). API acceptance: https://github.com/MiniMax-AI/parsar-core/actions/runs/36545481356 (passed). Full make check: https://github.com/MiniMax-AI/parsar-core/actions/runs/36545481344 (passed, including the full make check).

The final full CI run passed on d81efe5, including make check, API acceptance and all three native platforms.