[Windows Turnkey] Slice 5: Backend-owned managed OpenCode sidecar lifecycle

[Jay1]

What to build

Extend opencodeRuntime.ts to fully manage the OpenCode sidecar process in managed mode: start, stop, health check, ...
This is the core runtime lifecycle slice. The codebase already has startOpenCodeServerProcess using `ChildProcessSp...

How to verify

1. Call the sidecar start endpoint after OpenCode binary is on disk (Slice 4).
2. Backend spawns the process, health check passes.
3. Send a chat message through the managed sidecar.
4. Receive a response from OpenCode.
5. Call the stop endpoint. Process terminates cleanly.
6. Restart: fresh password generated (no reuse).

Out of scope

• Runtime profile creation (Slice 6).
• Health repair flow (Slice 7).
• WSL fallback (native first per PRD).
• Version pinning or update logic.
• Desktop IPC for sidecar management (backend owns it all).

Recommended approach

• Extend apps/server/src/provider/opencodeRuntime.ts (already has startOpenCodeServerProcess at lines 785-847).
• Add a managed profile mode that uses the downloaded binary from the managed runtime dir.
• Generate fresh password with crypto.randomBytes() — memory-only, never persisted.
• Use Effect's ChildProcess from effect/unstable/process with Windows shell mode (per ADR 0005).
• Health check via existing openCodeRuntimeHealth.ts.
• Session dispatch via existing provider session infrastructure.

Blocked by

• [Windows Turnkey] Slice 4: Managed OpenCode download and verify #72 (Slice 4: managed OpenCode download — binary must exist on disk)
• [Windows Turnkey] Slice 4: Managed OpenCode download and verify #72 (Managed OpenCode download — binary must exist on disk first)

References

• PRD: .brainstorm/windows-turnkey-release-prd.md (Decision 1, Decision 5, Decision 6)
• ADR 0005: docs/adr/0005-backend-owned-managed-runtime-sidecar.md
• Existing: apps/server/src/provider/opencodeRuntime.ts
  ... more issues

[Jay1]

Duplicate of #82

[Jay1]

Implemented in commit 153a7fe73.

Slice 5: Managed sidecar lifecycle

• Contracts: ManagedSidecarSnapshot schema with idle/downloading/starting/ready/stopping/error states
• Server: ManagedSidecarLifecycle service using Effect ServiceMap + Ref state machine with ManagedSidecarLifecycleLive Layer
• Fresh password per start (crypto.randomBytes(24).toString("base64url")), stored in snapshot only
• 16 tests: state transitions, error handling, password uniqueness, configMode verification

All tests pass (16/16), formatting clean.