[Haoming9527]

Refs #872. Stacked on #918 (work/872-task-spill-integration, base 454123e090636ae4a1ec861fa4faa6298e331e05). This is the private-channel storage slice; the full issue remains open.

What was wrong

Persistent-shell output channels retained only a bounded prefix. Reusing native full-stream spill also requires distinguishing authenticated pipe EOF from a pending file seal, and ensuring the session coordinator never drops an unconfirmed reader before managed-kernel shutdown.

The change

Add optional shared SpillStore capture to authenticated stdout/stderr channels. Only the real framed writer owns capture; empty metadata opens cannot forge EOF or seal a stream. Control and completion channels keep their existing framing. Full-path, seal and failure facts come from the existing shared output implementation, with no second store or writer queue.

Bound channel joining and preserve poisoned ownership. Known pending storage keeps the short descriptor-settlement grace from misclassifying a slow write/seal, while the request deadline remains effective. The session failure path checks both Driver and per-call capture cleanup, closes admission and invokes the Manager fatal callback before either owner can drop. Transport loss leaves admitted effects unknown and lets the public host retire the kernel.

The optional driver/example path and actual-process probe cover exact binary output, retained state, shared storage and existing retention. Production session metadata, ledger handoff and runtime activation are the next integration slice. No runtime eligibility, shipped pin, dependency or model-facing schema changes.

Validation

• Integrated cargo test --workspace --locked --manifest-path native/Cargo.toml: 730 passed, 0 failed, 6 ignored. Child fixtures are explicitly invoked by parent tests/probes; the separately gated UNC fixture retains its documented platform requirement.
• cargo clippy --workspace --all-targets --locked --manifest-path native/Cargo.toml -- -D warnings, worker/example build, formatting and diff checks: passed.
• Targeted channel/process tests: 37 passed, 0 failed, 4 child fixtures ignored at discovery. Worker tests before the base update: 19 passed, 0 failed, 1 child fixture ignored at discovery.
• Actual optional-spill candidate probe: 5/5 passed, including exact 1 MiB binary stdout/stderr across all three public sandbox modes and background commands followed by wait. Stock-runtime foreground-only probe: 5/5 passed. This stock result does not qualify its asynchronous output behavior for sessions.
• Existing candidate direct-driver regression: 18/18 passed. No observed owned survivors. Final example worker SHA-256 and raw reports are retained with channel-spill-{candidate,stock,driver-compatibility}-final.jsonl.
• Deterministic held-reader negative: the previous caller fails to signal fatal and hits its bounded test guard; the corrected caller passes by closing admission and invoking the actual Manager callback before Drop. Raw red and green logs retained.
• Workflow checks: 117 passed. Pre-rebase source-size check: 914 files, all below the unchanged 1,000-line limit; the integrated CI checks the expanded stack.
• This PR's own pull_request / CI required run: https://github.com/T-Auto/dsh-ops/actions/runs/43491308503 — completed successfully.

Environment

Windows x64, Node26.12.1, Rust1.99.0 locally; CI uses the repository-pinned compiler. Original stack main e724444416fed01eb1f75916ec556c0a286e73f9. Real checks use the public host subprocess/sandbox contract. Candidate Niubash remains a local reviewed backport, not a published distribution. No PR merge, release or deployment.