feat(desktop): manage per-Host Runtime Host update policy

[M4n5ter]

English

Problem

PRs #3720 and #3747 provide a bounded one-shot reconciler and OS scheduler adapters for managed Runtime Host updates, but Desktop cannot yet inspect or configure that policy per Host. Users must leave Desktop to understand whether a Host is on manual, fixed, latest, or next, whether scheduling is enabled, and why reconciliation is blocked.

Desired outcome

For each managed Runtime Host, Desktop should:

• show the installed exact version, configured policy, scheduler state, and bounded reconciliation outcome;
• allow the operator to choose manual | fixed | latest | next, including an exact version for fixed;
• provide an explicit foreground check/apply action;
• surface typed blockers without exposing raw SSH or service-manager details;
• reuse the existing management and one-shot reconciliation contracts rather than introduce Desktop-owned update state.

Background reconciliation must never interrupt active work. Any escalation that may interrupt work remains an explicit foreground decision.

Alternatives or workarounds

Operators can currently use the CLI management commands directly. That remains useful for automation and diagnostics, but it does not provide the coherent per-computer lifecycle promised by #3228.

Depends on #3720 and #3747. Tracks the remaining Desktop surface in #3228.

简体中文

问题

PR #3720 与 #3747 已为 managed Runtime Host 更新提供有界的一次性 reconciler 和 OS scheduler adapter，但 Desktop 还不能按 Host 查看或配置该策略。用户必须离开 Desktop，才能确认 Host 使用的是 manual、fixed、latest 还是 next、调度是否启用，以及 reconciliation 为什么被阻塞。

期望结果

对于每个 managed Runtime Host，Desktop 应当：

• 展示已安装的精确版本、当前策略、scheduler 状态和有界的 reconciliation 结果；
• 允许 operator 选择 manual | fixed | latest | next，其中 fixed 需要指定精确版本；
• 提供明确的前台检查/应用操作；
• 展示类型化 blocker，而不暴露原始 SSH 或 service-manager 细节；
• 复用现有 management 与 one-shot reconciliation 契约，不新增 Desktop-owned update state。

后台 reconciliation 绝不能中断 active work。任何可能中断工作的升级都必须来自明确的前台决策。

替代方案或当前做法

Operator 目前可以直接使用 CLI management command。它仍适合自动化与诊断，但无法提供 #3228 所要求的一致 per-computer lifecycle。

依赖 #3720 与 #3747，并跟踪 #3228 中剩余的 Desktop surface。