Validate runtime startup and clarify supported control boundaries

[bigboateng]

Change contract

When: A Go application starts Pitot with process registrations or relies on its documented control boundary.
Before: Direct runtime.Start callers could bypass configuration checks and launch unsupported registrations or panic on empty commands. Some public descriptions overstated the supported action scope and failure guarantees.
After: Startup validates every registration before launching children. Documentation distinguishes native shell control, application-issued requests, and host hook failures.

Boundaries preserved

• Empty embedded runtimes and resolved working directories remain supported; file configurations retain their existing requirements.
• Custom request kinds and configured allow/deny defaults keep their behavior.
• DeepSeek's explicit-reply requirement remains distinct from ordinary fallback defaults.

Evidence

Scenario or check	Expected result	Observed result
Invalid direct Go configuration	Error before process launch; no panic	Regression tests pass
Empty runtime, resolved directories, custom kinds and unavailable defaults	Preserve existing behavior	Go suite passes
Formatting and static checks	Pass	Pass
Maintenance suite	Pass	225 tests passed; three platform-specific skips
Adapter capture contract	Existing evidence remains valid for unchanged producers	All 11 adapter checks pass
Native Windows, macOS and Linux CI	Pass on this PR's exact commit	All 49 checks passed; 33 agent and three runtime results

Failure and recovery

Invalid registrations return an error and no runtime manager. Valid registrations whose executables are unavailable retain their configured fallback and diagnostic behavior. Revert this PR to restore the previous startup contract.

Remaining limits

A functioning hook's denial does not establish protection against every host or hook failure. The shipped priority integrations supervise shell tools; SDK support for usage envelopes does not add runtime usage collection.

[github-actions]

Pitot coding-agent E2E

Intelligence Flow is the verification source; Pitot's public README carries the latest main status.

Agent	Ubuntu	macOS	Windows	Result	Evidence
Claude	✅ Pass · real CLI 2.1.296 · native · binary-observed anthropic messages	✅ Pass · real CLI 2.1.296 · native · binary-observed anthropic messages	✅ Pass · real CLI 2.1.296 · native · binary-observed anthropic messages	✅ Passing	All platforms are required
Cursor	✅ Pass · real CLI 2026.10.01-e373342 · native · binary-observed cursor connect proto	✅ Pass · real CLI 2026.10.01-e373342 · native · binary-observed cursor connect proto	✅ Pass · real CLI 2026.10.01-e373342 · native · binary-observed cursor connect proto	✅ Passing	All platforms are required
Codex	✅ Pass · real CLI 0.162.1 · native · binary-observed openai responses	✅ Pass · real CLI 0.162.1 · native · binary-observed openai responses	✅ Pass · real CLI 0.162.1 · native · binary-observed openai responses	✅ Passing	All platforms are required
Devin	✅ Pass · real CLI 3000.11.3 · native · binary-observed devin connect proto	✅ Pass · real CLI 3000.11.3 · native · binary-observed devin connect proto	✅ Pass · real CLI 3000.11.3 · native · binary-observed devin connect proto	✅ Passing	All platforms are required
DeepSeek Harness	✅ Pass · real CLI 0.2.0-rc.2 · native · binary-observed openai chat	✅ Pass · real CLI 0.2.0-rc.2 · native · binary-observed openai chat	✅ Pass · real CLI 0.2.0-rc.2 · native · binary-observed openai chat	✅ Passing	All platforms are required
GitHub Copilot CLI	✅ Pass · real CLI 1.0.95 · native · binary-observed openai chat	✅ Pass · real CLI 1.0.95 · native · binary-observed openai chat	✅ Pass · real CLI 1.0.95 · native · binary-observed openai chat	✅ Passing	All platforms are required
Gemini	✅ Pass · real CLI 0.63.0 · native · binary-observed gemini generate content	✅ Pass · real CLI 0.63.0 · native · binary-observed gemini generate content	✅ Pass · real CLI 0.63.0 · native · binary-observed gemini generate content	✅ Passing	All platforms are required
Kimi Code	✅ Pass · real CLI 2.1.1 · native · binary-observed openai chat	✅ Pass · real CLI 2.1.1 · native · binary-observed openai chat	✅ Pass · real CLI 2.1.1 · native · binary-observed openai chat	✅ Passing	All platforms are required
OpenCode	✅ Pass · real CLI 2.0.27 · native · binary-observed openai responses	✅ Pass · real CLI 2.0.27 · native · binary-observed openai responses	✅ Pass · real CLI 2.0.27 · native · binary-observed openai responses	✅ Passing	All platforms are required
Pi	✅ Pass · real CLI 1.1.0 · native · binary-observed openai chat	✅ Pass · real CLI 1.1.0 · native · binary-observed openai chat	✅ Pass · real CLI 1.1.0 · native · binary-observed openai chat	✅ Passing	All platforms are required
Qwen Code	✅ Pass · real CLI 0.25.1 · native · binary-observed openai chat	✅ Pass · real CLI 0.25.1 · native · binary-observed openai chat	✅ Pass · real CLI 0.25.1 · native · binary-observed openai chat	✅ Passing	All platforms are required

Runtime capabilities

Capability	Ubuntu	macOS	Windows	Result
pitot request	✅ Pass · real runtime allow/deny	✅ Pass · real runtime allow/deny	✅ Pass · real runtime allow/deny	✅ Passing

Source commit: 045c505a3f63