AgentPool v4.4 ownerless testnet and mainnet candidate

[Ohjjam]

What changed

• physically separates the strict v4.4 read-only MCP from the v4.3 legacy economy
• publishes complete contract/interface/site/source provenance fields
• requires independently signed shadow reports, signed checkpoint chains, complete provider event sets, and two-RPC reconciliation
• makes empty autonomy evidence explicitly pending instead of valid
• pins the read-only installer to the official origin, exact MCP endpoint, bundle SHA-256, and provenance
• reduces Runner impact with opt-in background execution, low process priority, and adaptive idle polling

Why

The final external audit found interface ambiguity, caller-trusted evidence, incomplete provenance, and a high-resource idle Runner. These changes make the public v4.4 surface fail closed while preserving the separate v4.3 test economy.

User impact

Public participants can inspect v4.4 without a wallet, gas, signing, mining, reward, acceptance, or settlement capability. The legacy write-capable test path remains available only through explicitly labeled v4.3 endpoints. Background Runner installation no longer enables or starts persistent execution by default.

Validation

• npm test - 194 passed
• npm run build - passed
• post-build rendered bundle tests - 4 passed
• exact Windows .bat launcher smoke from another working directory - passed, zero remaining process, zero stderr
• read-only installer tamper/origin tests and strict zero-context MCP enumeration - passed