feat(desktop): share Runtime Host sessions with guests

[M4n5ter]

English

Summary

Add the first Desktop Owner / Guest sharing surface. An Owner can create an informed one-time invitation and revoke access; a Guest can import that invitation without an existing Host profile or Owner credential and receives an observation-only Desktop surface. Plaintext sharing requires explicit confirmation before the Guest credential is issued.

Refs #3843

Verification

• npm run build:test
• npm --workspace @maka/desktop run typecheck -- --pretty false
• node --test apps/desktop/dist/main/__tests__/runtime-host-collaboration-ipc-main.test.js apps/desktop/dist/main/__tests__/runtime-host-desktop-candidate.test.js apps/desktop/dist/main/__tests__/runtime-host-profile-service.test.js
• npm run astryx:surface-inventory

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented and verified the change under the maintainer's direction and review.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

加入首个 Desktop Owner / Guest 分享界面。Owner 可在明确知情后创建一次性邀请并撤销访问；Guest 无需已有 Host profile 或 Owner credential 即可导入邀请，并获得只观察的 Desktop 界面。通过 plaintext 分享时，必须先明确确认风险，之后才会签发 Guest credential。

关联 #3843

验证

• npm run build:test
• npm --workspace @maka/desktop run typecheck -- --pretty false
• node --test apps/desktop/dist/main/__tests__/runtime-host-collaboration-ipc-main.test.js apps/desktop/dist/main/__tests__/runtime-host-desktop-candidate.test.js apps/desktop/dist/main/__tests__/runtime-host-profile-service.test.js
• npm run astryx:surface-inventory

AI 使用

OpenAI Codex 在维护者的指导和审核下参与了实现与验证。

[jackwener]

I reviewed exact head 2c1ed8a926f961b39c5b52f564dbada2824290d5 and found no blocking issue. Invitation import binds the advertised root and transport, plaintext sharing requires explicit confirmation on both sides, Guest profiles cannot become the default, and the Guest Desktop candidate registers only the shared observation/resource surfaces while omitting Owner domains and native capabilities. Desktop build and typechecks, the complete Desktop main suite, and the changed-area tests pass.

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.