[pcvantol]

Scope

Continues L1-FORGE-PLATFORM-MANAGED-INSTALLER-V1-20260923 and PR #75 lineage. The released GUI/CLI runtime carries the sealed current installer version into each production helper XPC transport. Before each request, the transport independently reads the one fixed ServiceManagement parent and requires that exact version. A stale, absent or ambiguous parent blocks before the connection is resumed or the remote proxy is used. The CLI's separate native helper registration/transition route remains reachable.

The 0.3.6 public artifact is immutable and is not changed by this PR. The live 0.2.4 qualification helper is RUNNING (runs=1); this PR does not unregister, kill, reboot, or mutate it. The current idle-only transition remains blocked. A future canonical release must contain this source change before it can qualify live.

Exact local evidence

• Base 0cb2dd667394134ada301172b67fde5f9914a70a; reviewed head c8fdafaad009db76ba7e960cfd78250869cd7fb4
• scripts/validate.sh: PASS
• swift test --enable-code-coverage: 1,255 core tests and 27 CLI tests, zero failures
• strict >80.2% executable-line coverage PASS for all five changed production files: runtime builder 93.57%, post-tool transport 94.58%, parent admission 91.43%, product transport 85.76%, released-route transport 91.14%
• a negative anonymous-XPC test proves stale parent rejection before resume; exact/missing/stale parent admission tests pass

Protected exact-head Foundation/native, CodeQL, canonical versioning and TDE gates are required before merge. No live helper, credential, product or clean-install PASS is claimed.