epic: Desktop Singleton-Graph Deployment — install/update/supervise one artifact

[rickylabs]

Epic — Desktop Singleton-Graph Deployment

Part of #327. No closing keyword.

The eis-chat#150 shape productized: a native window supervising an adjacent process graph — for apps whose native constraints demand processes (exclusive-lock DB engines, external tools like Garnet, crash/permission isolation). Ships after the PM foundation (#510, beta.12) and the unified marquee (#823, beta.13) → milestone 0.0.1-beta.14 (owner-ratified sequencing: desktop is a consumer of both, never the starting point — a desktop graph without PM reproduces the POC's launch-only-supervision failure as a product).

Foundations consumed: PM engine + control plane (F1), packaging pipeline + NetScript.Aspire.Packaging #825 (F2), installation layer (F3), snapshot-update transaction extending #456 (F4), runtime surface (F5) — PR #822 RFC §4.

Sub-issues

Design source: PR #822 (rfc.md + plan.md rev 10, 9-cycle adversarial trail) in .llm/runs/rfc-single-deployment--orchestrator/.

• SD-1 feat(desktop): supervisor host — embedded PM engine (per-user) / client mode (per-machine) [SD-1] #832
• SD-2 feat(deploy): PackagingModel + InstallGraphManifest compiler + Aspire publish step [SD-2] #831
• SD-3 feat(deploy): installers — scopes, least-privilege ACLs, journaled operations, port registry [SD-3] #833
• SD-4 feat(deploy): graph update transaction — N-artifact snapshots, barriers, quiescence [SD-4] #834
• SD-5 feat(deploy): first-run provisioning phase [SD-5] #835
• SD-6 feat(sdk): end-user health surface widget over the control plane [SD-6] #836
• SD-7 docs/test(deploy): composition-modes doctrine + cross-mode conformance suite [SD-7] #837
• SD-8 test(deploy): graph deploy e2e — both scopes + full fault suite [SD-8] #838
• SD-H feat(deploy): Linux OS-enforced containment backstop — PDEATHSIG/cgroup spike [SD-H] #839 (stable)