feat(runtime): report installation provenance

[dubesinhower]

Closes #380.

Root cause

Konnect's package semver was the only build identity. Release builds did not embed the exact checkout, client status inspected static guidance rather than the serving process, and the runtime had no process-scoped provenance collector or conservative on-disk-versus-running comparison.

Implementation

• add an always-visible, zero-argument get_installation_info MCP tool;
• report the serving version, embedded commit and source when available, build profile/target, and current executable path;
• classify KiCad PCM only from the exact public plugin identifier and executable runtime type, otherwise return unknown;
• probe the executable at the serving path and the resolved kicad-cli with read-only, kill-on-drop, five-second-bounded --version calls;
• report newer_than_running only when both values are comparable stable versions;
• return the resolved IPC endpoint with credentials, query data, and fragment data redacted;
• return Windows, macOS, Linux, and PCM-specific restart guidance;
• embed Git HEAD for source builds without invoking Git, and embed ${{ github.sha }} in release artifacts;
• update public docs and generated tool counts (221 registered + 7 meta = 228 total; baseline 21).

The diagnostic does not mutate configuration or installation state, scan processes, dump environment data, or expose subprocess error text.

Dependency and branch shape

• based directly on main after merged feat(review): add hierarchy scope to standalone audits #379 (e7aeaa6a1b353fa758c5246b58a18899275d13ef);
• exactly two unique commits: the provenance feature and its stdio portability follow-up;
• the previous history-only upstream merge commit has been removed;
• git range-diff reports both reconstructed commits as patch-identical to the reviewed commits from the previous head.

Regression coverage

• five unit tests cover exact PCM-manifest classification, endpoint redaction, conservative version comparison, embedded commit shape, and platform guidance;
• a real stdio MCP test covers always-visible registration, serving-process output, on-disk probing, newer comparison, and endpoint redaction;
• the endpoint-redaction guard was deliberately neutralized during development and the stdio regression failed on its synthetic query/fragment values, then passed after restoration;
• documentation registry/count contracts and asset references pass;
• the final release binary reports konnect 0.11.0 and contains exact branch head a2c9e20bc643479f7aaf8ecd066eb0529e9711de.

Verification on the final head

• cargo xtask fix-doc-counts — pass; documentation already current, no rewrite required
• cargo fmt --all -- --check — pass
• cargo clippy --workspace --locked --all-targets -- -D warnings — pass
• cargo test --workspace --locked --lib --tests — pass, unfiltered; installed KiCad demo-board corpus passes
• cargo test --workspace --locked --doc — pass
• cargo test --locked -p konnect-core runtime_info::tests --lib — 5 passed
• cargo test --locked -p konnect --test protocol_stdio installation_info_reports_the_serving_process_without_leaking_endpoint_secrets -- --exact — 1 passed
• cargo test --locked -p konnect --test doc_tool_counts — 6 passed
• cargo test --locked -p konnect --test asset_references — 12 passed
• cargo build --release --locked -p konnect — pass; version and exact embedded head verified

Repository-declared ignored tests that require a live KiCad GUI, the intentionally slow wedged-server timeout, or the dedicated KiCad E2E workflow were not forced locally. The changed behavior itself is covered by hermetic unit tests and a real child-process stdio MCP test.

Compatibility and risk

This is additive: no existing tool or argument changes. Baseline tools/list grows by one always-visible tool, so the change requires minor-release planning.

Provenance remains deliberately conservative: non-PCM standalone channels remain unknown, prerelease or non-triplet versions produce a null newer comparison, and working-tree state is not_recorded. Local runtime and release-binary verification is Windows; platform guidance is selected at compile time, while hosted macOS/Linux CI validates those builds.

The tool intentionally returns the serving executable and resolved KiCad CLI paths so a user can identify the active binary. It does not enumerate unrelated files. Issue #103 remains the separate process-lifecycle fix.

[neusse]

Reviewed current head 504a8c0a9415420c81ea799f105ae6afeac18292 against #380.

The diagnostic is conservative and evidence-based: it reports the serving executable, build identity, verified/unknown installation source, bounded version probes, redacted endpoint information, comparable-version status only when provable, and platform-specific restart ownership. It adds an always-visible public tool, so this is a minor-release change.

Queue position: after #379, and this is the final foundation PR before the stacked ownership/hierarchy train is rebuilt. Please wait for #379 to merge, then update #381 once onto current main, regenerate counts with cargo xtask fix-doc-counts, and rerun the full unfiltered gate. The older #176 also changes the meta-tool catalogue/count area; it may need reconciliation later, but that should not make this branch repeatedly absorb unrelated queue movement now.

After #381 lands, #388 should be rebuilt from the resulting main with only its unique ownership work. Do not try to preserve the copied prerequisite commits in #388.

[neusse]

The implementation itself does not currently need a behavioral redesign. To make this PR ready to merge, please:

1. Rebase the branch onto current main.
2. Drop the obsolete merge-noise commit; keep the installation-provenance implementation and its test-fix commit.
3. Run cargo xtask fix-doc-counts after the rebase.
4. Resolve only any mechanical documentation or generated-count overlap.
5. Push the updated branch and let all ten required CI checks rerun.

Once the updated head is clean, 10/10 checks are green, and the issue-closing link remains intact, it should be ready for the final merge check. No unrelated feature changes are requested.

[dubesinhower]

@neusse #381 is ready for final merge on exact head a2c9e20. It is rebuilt directly on the merged #379 foundation as exactly two patch-identical feature commits; cargo xtask fix-doc-counts reports the documentation current, the complete unfiltered local contributor gate passes, the release binary embeds the exact head, and all 10 hosted checks are green. The author account cannot execute the upstream merge. Please merge when ready; per your queue direction, #388 is next and will be rebuilt from the resulting main with only its unique ownership work.