Qualify native non-root EP and prepare 2.3.106 runtime fix

[pcvantol]

Scope

Add explicit-input macOS non-root qualification harnesses and canonical OI-2/OI-5 evidence for the published EP 2.3.105 wheel. Prepare the normal 2.3.106 immutable release for the reproduced EP runtime-slot installation defect: venv and pip children now use the owned slot as their working directory, independent of the caller's private or inaccessible cwd.

Native evidence

• On the intended Mac mini, a separate non-admin UID/GID 20000 with SecureToken disabled ran the exact published 2.3.105 wheel under Python 3.14.7. The real process, executable and loopback API reported the expected instance, release and observed wheel digest 22dd1e49c263b55dc9eee396810a09fc43509984fe685f3c00d26289d55e8adc.
• A product-created disposable scoped API credential authenticated exact consumer/instance readback. Missing bearer and wrong project scope rejected; no token is included here.
• A/B live identity separation, synthetic cross-UID filesystem denial, non-writable data parent, installed package immutability, absent provider UNAVAILABLE state and normal foreground restart passed.
• No LaunchDaemon/Agent, provider login, production instance, real credential, reboot or installer acceptance is claimed.

Reproduced lifecycle defect and open native continuation

The separate UID-20000 preserve/restore attempt stopped before lifecycle mutation. Actual child stderr shows pip's os.getcwd() raising PermissionError because the released provisioner inherited the caller's inaccessible cwd. A two-line production fix binds both slot-installation subprocesses to the owned slot; the targeted test asserts both child calls carry that cwd. The published 2.3.105 artifact remains unchanged. The native lifecycle rerun used an accessible disposable cwd to qualify those released bytes: a real initial foreground Server ran under UID/GID 20000; preserve retained identity/data, and restore stayed inactive with provider reverification required. This is an adapted service-boundary PASS, not launchd or live provider authentication. This PR prepares the 2.3.106 version projections; after protected merge, the normal release workflow must publish new immutable bytes and those actual published bytes must be requalified under UID 20000.

The lifecycle harness uses a filesystem-only service adapter and deliberately failing synthetic provider executables. An interactive-UID dry run is not native evidence. Both parameterized repository harnesses have now run under the admitted UID/GID 20000 with the unchanged published 2.3.105 wheel: the foreground/API runner returned PASS_WITH_DECLARED_LIMITS, and the lifecycle runner returned PASS_ADAPTED_LIFECYCLE_WITH_REAL_INITIAL_SERVER. Final exact-head protected gates remain required before merge.

Validation

• Targeted system-instance provisioner suite: 28 tests passed on Python 3.14; version-preparation suite: 20 tests passed; version consistency: 11 components at 2.3.106; extraction baseline audit: valid. Both scripts compile. Full-suite coverage on the modified production module: 507/581 executable lines, 87.26%, above the required strict 80.2%.
• Full local Python suite at the preceding head: 2,088 tests, 4 failures and 1 error in existing release-helper workflow tests on macOS Bash 3.2. The hosted validate gate passed there; it must pass again on this head.
• Protected Trusted Delivery, security and CodeQL gates must qualify the final exact head.

Risk and rollback

The source fix changes only the child cwd inside an already created, owned runtime slot. No production host action is in this PR. The separate test account and disposable data remain retained for bounded diagnosis and cleanup. Revert the commit if the slot behavior regresses; do not relabel the old wheel as corrected.