[CoreyShupe]

Summary

• Defer Claude bridge/SDK setup to its provider supervisor so cold npm installation cannot block account registration and the shared runtime actor.
• Bound npm installation to 120 seconds and terminate/reap its direct child on timeout or cancellation.
• Serialize in-process SDK preparation and require a versioned successful-install receipt plus the SDK entrypoint; invalidate stale receipts before retry.

Evidence

A fresh FStack guest had a registry ECONNRESET and a >20-minute SDK installer while authenticated Host routes worked but Nakode status/workspace requests timed out. This fixes the shared-actor dependency, not registry availability.

Validation

• cargo test --all-targets --all-features --jobs 2: 1,182 passed, 1 ignored
• cargo fmt --all -- --check: passed
• cargo clippy --all-targets --all-features --jobs 2 -- -D warnings: passed
• Independent review completed; stale-success-marker finding fixed and regressions rerun.

Limits

Provider-local first-command setup still uses the existing serialized recovery path; it can wait for the 120-second installer budget. This does not claim immediate provider-local command processing during setup. FStack runtime pin/release integration and live provisioning verification are separate follow-through.