feat: converge template selectors, runtime binding, graphics contract, and mcpp-bin AUR #398

Goal

Implement the approved focused design in one mcpp pull request, then complete the release and ecosystem follow-through.

Design source:

• .agents/docs/2026-08-09-mcpp-template-runtime-graphics-aur-focused-design.md
• umbrella analysis: 汇总:2026-08-09 全量 issue 核验 —— 关闭说明、合并去向,以及 9 条新发现缺陷的收口 #397
• related runtime/scaffold defects: bug: mcpp new accepts unsafe names and can hang during template rendering #380, [Linux] mcpp run 无法启动：私有 glibc 2.39 与系统库 GLIBC 版本冲突，以及切换 glibc 2.44 过程中的排查与发现 #392, Build-time physics check for form-X binaries (rules A/B): fail at link time instead of crashing at run time #396

Frozen product decisions

1. Template/package selectors use [ns.]name[@version][:tname].
   • omitted namespace is exactly mcpplibs
   • dotted namespace is exact
   • no --variant
   • a sole template without default = true is the default
2. xlings owns graphics/runtime providers; mcpp-index declares C++ package relationships; mcpp remains provider-neutral and does not probe GPUs.
3. Runtime selection is only McppDefault or root/workspace-root [xlings].subos.
   • no CLI override
   • SubOS is local build/run context
   • dependency/member SubOS declarations are non-transitive
   • RuntimeBinding isolates caches and is shared by build/run/test
4. AUR automation reconciles only mcpp-bin.
   • mcpp-m package files and AUR remote are untouched
   • event + schedule + manual recovery
   • idempotent, monotonic, checksum-verified, fast-forward-only

Acceptance

• RED/GREEN coverage for shared selector parsing, exact namespace resolution, template defaults, transactional scaffold and safe project names.
• RED/GREEN coverage for default/named SubOS selection, root-only/non-transitive behavior, RuntimeBinding fingerprinting and platform boundaries.
• Generic graphics/runtime contracts carry canonical requester/provider provenance without mcpp GPU/vendor branches.
• Release emits an immutable asset manifest; the mcpp-bin reconciler validates both Linux artifacts and converges without touching mcpp-m.
• Pin the latest stable xlings at implementation time and keep all pin sites consistent.
• Update CLI/user/spec/release/AUR documentation.
• Local unit/E2E/release gates pass.
• Use one mcpp Draft PR; every logical change is committed and pushed separately, then recorded with a PR checkpoint comment.
• Do not rewrite branch history. After explicit user review and terminal latest-head GitHub Actions, use the normal non-admin merge path and create the new release.
• Do not include local usernames, absolute workspace/home paths, credentials, or other private information in commits, documentation, PR text, or checkpoint comments.
• Follow through mcpp-index/GitCode resources and validate the released xlings ecosystem from isolated fresh homes.

Non-goals

• no --variant
• no CLI SubOS override
• no mcpp GPU/vendor/ICD probing
• no mcpp-m maintenance or publish
• no mcpp-git publish path
• no unrelated C1-C9 cleanup