feat(computer-use): add platform binding selection with typed unavailable results - #5306

Technical conclusion: NO-GO due to one P2.

This change adds a darwin -> maka-cu platform binding, platform injection seams for cross-platform tests, typed unavailable results, and removes the unused child-argument seam. The fail-closed selector behavior works, but the new unavailable reason is dropped before Desktop capability reporting, so the user-facing distinction described by this PR is not implemented.

Validation completed on this exact head: build:test; full typecheck, lint, format, ASF-header, locale, TUI-copy, Astryx, renderer-architecture (112/112), and E2E-budget checks; Computer Use 120/120; Desktop 2492/2492; focused changed-path tests 67/67; Electron E2E 38/38; and git diff --check. The head cleanly merges with current main c22768c3b0dc47518f6f8584e864f86f0b1e5379. GitHub currently exposes only the successful label check, not a hosted test check.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

Thanks — the shape of this reads well, and in particular the reason now survives the whole path (selectComputerUseBackend → native.computerUse → computerUseServiceHealth → computerUseCapabilityReasons → locale copy), which is the link that usually gets dropped. Two comments and a few nits.

The ?? process.platform default is now the only untested branch

Every selectComputerUseBackend / createComputerUseHost call in the suites now passes platform explicitly (packages/computer-use/src/__tests__/select-backend-host-events.test.ts:48,93,109,128,133,146, packages/computer-use/src/__tests__/maka-cu-backend.test.ts:1556,1568,1585, apps/desktop/src/main/__tests__/computer-use-host.test.ts:99,109,122,138,150,178), so nothing pins the seam default at packages/computer-use/src/select-backend.ts:157 or apps/desktop/src/main/computer-use-host.ts:75. A regression there — deps?.platform ?? 'darwin', or dropping the ?? — would keep every suite green on every CI OS while turning the platform decision back into a constant, which is exactly the failure this PR removes. Previously the Darwin assertions exercised process.platform implicitly; after this change that path has no test at all.

One assertion per entry point would close it, e.g.:

// no `platform` seam: the host's own platform decides
assert.equal(
  selectComputerUseBackend({ binaryPath: '/tmp/fake', expectedBinarySha256: '0'.repeat(64), createBackend: () => stub() }).backendId,
  process.platform === 'darwin' ? 'maka-cu' : 'none',
);

unavailableReason isn't tied to backendId: 'none' by the type

select-backend.ts:85-96 permits any combination, while its own doc says "A missing reason means a backend is live". computerUseServiceHealth reads the reason only on the 'none' branch (computer-use-host.ts:174), so a caller passing a reason alongside a live backendId is silently ignored rather than rejected at compile time. Since the point of the PR is that this is a typed fact, a union states it once (shape flexible, emptyTools() stays shared by both arms):

type SelectedComputerUseBackend =
  | { backendId: 'none'; unavailableReason: CuUnavailableReason; tools: ComputerUseToolSet }
  | { backendId: CuBackendId; backend: DisposableBackend; tools: ComputerUseToolSet };

Only select-backend.ts constructs this value today, so the change is contained. It would also let runtime-host-boot.ts:1749-1756 pass the selection through instead of threading a third positional argument, which is what currently allows the pairing to drift between the two call sites.

Nits

• Two places now name the shipped executor. select-backend.ts:186 returns binding.id, but DEFAULT_CU_BACKEND_ID is still exported and still asserted (maka-cu-backend.test.ts:1583), and the comment above the host's selection call still reads "the host takes whatever DEFAULT_CU_BACKEND_ID names". They agree because there is one row; if a second row ever ships a different id, the constant and that comment go stale with nothing failing. Deriving the constant from the table — or rewording the comment to name CU_PLATFORM_BACKEND_BINDINGS as authoritative — keeps the "one decision" property the comment is protecting.
• platformLabel has no reader. It is documented as "Human label for capability reporting", but the capability layer only ever emits cu_platform_unsupported (computer-use-capability-reasons.ts:43-45, capability-snapshot.ts:136-160). CU_PLATFORM_BACKEND_BINDINGS / CuPlatformBackendBinding are also exported from packages/computer-use/src/index.ts with no consumer outside select-backend.ts; knip.json only covers apps/desktop and packages/ui, so no gate will flag it. Fine as a forward declaration — just worth adding when the copy actually wants it.
• "Production callers omit them" (select-backend.ts:146-150, README "Platform abstraction") is no longer literally true: the Desktop host always passes platform (computer-use-host.ts:75). A clause like "…or a host may forward its own resolved platform" would keep the doc honest.

Verified, no action needed

• The three no-backend states really are distinct end-to-end: unavailableReasonCode (computer-use-host.ts:151-156) maps them to cu_platform_unsupported / cu_backend_unavailable / cu_executor_undistributable, and computerUseCapabilityReasons makes the feature and probe rows agree for a none selection instead of reporting cu_artifact_missing.
• Copy completeness is enforced rather than hand-checked: CapabilityReasonCopy = Record<CapabilityReasonCode, string> plus apps/desktop/src/main/__tests__/health-center-copy.test.ts:103-121, which requires non-fallback copy for every code in all three locales. All three got the new string (capability-reason-copy.ts:34,59,84).
• Selection precedence is right: the binding lookup (select-backend.ts:158) runs before the digest check, so an unbound platform reports unsupported_platform rather than missing_executable, and the packaged/digest failures on Darwin still land on the undistributable code they had before.
• The newly un-skipped tests are CI-OS-safe: createMakaCuBackend and MakaCuService have no process.platform gate and spawn lazily, so an injected platform: 'darwin' only steers selection and never reaches a macOS-only API. Since verification reports a macOS run, the first Linux/Windows CI run is what proves the "runs on every CI OS" claim.
• Commit 2 adds childArgs and then removes it, so the spawn site is unchanged (['host']) in the net diff — only churn, no review needed.