[REQ-098] Extension environment isolation and updater alignment

[jinjunnn]

Goal

实现 prod/beta/dev mutable roots、channel mapping、旧布局迁移与 updater 校验。

Parent requirement

jinjunnn/alpha-code#209

Scope

• Deliver the jinjunnn/alpha-code boundary for Alpha REQ-098: Extension environment isolation and updater alignment.
• Preserve the parent requirement contract; do not absorb adjacent repository work.

Out of scope

• Work owned by sibling sub-issues or future REQs.

Acceptance criteria

• 跨环境 state/secret 隔离；错误 feed loud-fail；迁移/回滚幂等。
• Relevant automated and packaged/runtime checks are attached before closure.

Dependencies

与 REQ-099 联合设计。

Verification evidence

• CI/test evidence.
• Security/runtime/product acceptance evidence appropriate to this repository.

[jinjunnn]

验收证据(S41,PR #239 已合并)

• ✅ AC#1 隔离:prod/beta 同 ID 不同版本扩展的 config/receipt/grant/secret/进程互不可见(测试驱动真实 persistMcp/addReceipt/writeMcpSecret 跨两环境)
• ✅ AC#2([拍板] NON_GOALS「多渠道不主动维护」vs REQ-098/101 通道激活 —— beta/preview 是否成为受维护发布面 #232 拍板 B 收窄):beta 运行时改查 beta/preview feed(原硬编码 latest);打包 feed owner/repo/channel 错配 = 启动错误弹窗 + 禁用 updater;发布管线未动,preview 维持 ADR-012 休眠
• ✅ AC#3 幂等迁移:跑两次逐字节一致;tmp+原子 rename 崩溃可重试;receipt 为唯一完成凭证;源文件零改动(字节快照断言)
• ✅ AC#4 回滚:降级后旧布局可读;带 receipt 再升级不重复复制
• ✅ AC#5:空格+Unicode 根全覆盖;Windows 盘符/反斜杠经纯函数测试,跨盘符外源引用 fail-closed(真 Windows fs 未跑,如实注记)
• ✅ AC#6 防伪造:环境只由 app.isPackaged + 构建冻结 CHANNEL 派生,boot 冻结快照,IPC 零参只读;grep 门锁 ALPHA_GLOBAL_DIR 赋值点
• 真机证据:window.api.environment() 快照(docs/audits/2026-07-12-s41-visual/00-env-snapshot.png);36 项新测试全绿(ui-mac 套件 802/0)
• 📌 Residuals:本地 dir-target 构建仅校验运行时映射;registry channel 映射待 REQ-102 消费;「清除全部数据」只清当前环境根(uninstall 文档待补注)