Set up hosted nodes from the paired Core console

[SaladDay]

Default installations start Core, the paired Web console and PostgreSQL with zero execution nodes. Administrators choose Docker or microsandbox in Web, then copy one command to a prepared Linux host. The command installs the matched node and Runtime, enrolls the node and starts its user service; Web refreshes connection and readiness automatically.

The first provider and reachable Core origin persist and activate the existing node-backed Runtime path without a Core restart. Paired Web login authorizes sandbox administration with a server-held credential. Node and daemon authentication pass through unchanged; only fixed non-secret distribution artifacts are downloadable. Installation retries preserve node identity and configuration.

Validation:

• Complete make check on integrated candidate 3a947c5, using dedicated local PostgreSQL on mx1 and RUST_TEST_THREADS=1. Passed, exit 0; all 112 browser cases passed. The serial Rust setting isolates an existing process-wide descriptor-count test race without removing tests or weakening assertions; recorded as TEST-QUAL-001.
• 51 installer tests, 5 distribution-manifest tests, 135 Claude SDK tests, 376 client tests, 678 Web unit tests, PostgreSQL/race and actual WebSocket proxy checks passed. SQL and OpenAPI generation checked.
• Fresh default distribution install: 22 checks plus identical-command retry passed, including zero execution authority in Core, paired login, private-file denial and persistent setup.
• Real Docker and microsandbox enrollment, 5 Kimi/Codex Turns, Files/Artifact content, Core restart continuation and microsandbox's default 300-second sleep/restore passed. Patched installer retries retained identity/configuration. Task services were stopped and execution resources cleaned; unrelated services preserved.
• After main Add Session runtime metrics tab #51 added Session metrics reads, synchronize the existing pagination browser test with snapshot completion and assert four complete page chains; three consecutive targeted runs passed. No production changes for this correction.
• Astra high reviewed the complete diff and rechecked the two reproduced retry fixes. Fresh-agent creation was blocked by the thread limit, so the user-authorized existing-context reviewer was reused; this is not a fresh-context blind review. No remaining substantive findings.

Scope and limits: one provider per deployment; Linux amd64 hosts with Docker access or KVM/native prerequisites and user systemd/linger. Core and Web stay paired. DNS/TLS are operator prerequisites; private TLS and public-origin Host routing were exercised, not an external production domain. This batch requalified Codex/Kimi, not every harness. No mixed providers, provider migration, SSH credential collection or new execution architecture. Matched local acceptance artifacts were used; this PR does not publish a release.