Add durable admin-only component preparation

[thymikee]

Part of #70. See ADR 0021.

Purpose

Add a durable admin operation that installs missing platform components before a Host lease request.

#67 and #69 provide the iOS and Android installers. This issue adds the operation boundary that Host needs.

An ordinary Host lease request must never start a component download.

Proposed API

Use the same ManagedShapeRequest contract and canonical resolver as #72.

interface ComponentPreparationRequest {
  operationId: string;
  spec: ManagedShapeRequest;
}

type ComponentPreparationState =
  | "resolving"
  | "downloading"
  | "installing"
  | "reconciling"
  | "succeeded"
  | "failed";

interface ComponentPreparationStatus {
  operationId: string;
  spec: ManagedShapeRequest;
  resolvedSpec?: ResolvedDeviceSpec;
  state: ComponentPreparationState;
  componentId?: string;
  progress?: { completedBytes?: number; totalBytes?: number };
  error?: SimlockError;
}

interface SimlockAdminClient {
  prepareComponents(
    input: ComponentPreparationRequest,
  ): Promise<ComponentPreparationStatus>;
  getComponentPreparation(input: {
    operationId: string;
  }): Promise<ComponentPreparationStatus>;
}

The exact progress fields can follow the installer. The durable operation ID, state, resolved shape, and terminal result are required.

Authorization and policy

• Expose this operation only through the authenticated admin client from Export a supported typed client for the local daemon #71.
• Keep admin preparation permission separate from lease-request download permission.
• Let the Host install profile disable all lease-triggered downloads while it enables this admin operation.
• Do not call this operation from requestLease, warm convergence, startup convergence, or catalog reads.
• Do not expose the operation through an unauthenticated or agent-role HTTP route.

Existing --allow-download behavior can remain available to ordinary Simlock workflows. Host does not use it.

Shape resolution

Resolve the request through the same canonical catalog rules as allocation:

• An omitted OS selects the newest compatible installed runtime. If none is installed, return a typed missing-component result without a download.
• An explicit major selects the newest compatible installed minor. If none is installed, return a typed result that asks for an exact version.
• An exact version matches or prepares only that version.
• An unknown device type or incompatible device and OS combination fails before download.

After installation, re-scan the catalog and publish the resolved installed shape. Do not report succeeded from the installer exit code alone.

Required behavior

• Store the immutable request before resolution or download starts.
• Use operationId as the durable idempotency key.
• Return the stored operation when the client repeats the same input.
• Return IDEMPOTENCY_CONFLICT when the same ID has different input.
• Perform disk admission before each component download.
• Deduplicate concurrent work for the same component without merging different operation results.
• Persist progress and the terminal result.
• After a client or daemon restart, resume safe work or reconcile the installer result before reporting a terminal state.
• Return typed results for an unknown device type, unsupported version, missing authorization, low disk, download failure, and install failure.
• Do not let request input select a filesystem root or installer command.

Completion conditions

• A Host lease request cannot download a component, even when it supplies a download flag.
• An authenticated admin request can prepare an iOS runtime or Android system image through the supported client.
• Omitted, major-only, and exact OS requests produce the same resolved shape in preparation and later allocation.
• A missing or invalid admin credential causes zero installer calls.
• A repeated operation ID does not start a second download.
• A daemon restart during download or install keeps one recoverable operation and one terminal result.
• Low disk refuses the operation before the installer starts.
• A successful result means that a later fail-fast lease request can resolve the published shape without a download.
• Tests cover lost responses, daemon restart, idempotency conflict, low disk, and unauthorized requests for both platforms.

Depends on #67, #69, #71, and #72.