feat(round2+round3): 完整实现 A/B/C/D 主线 + round3-F/H 修复

Round2 主线:
- A: 事件落库地基 (RuntimeApp EventStore 单例 + 14 repo wiring)
- B: 执行体对齐 (read-before-edit, verification-before-completion)
- C: 界面对齐 (@opentui/solid, 删除 runtime 依赖)
- D: 经验闭环 (ExperienceMiner, DebuggerRole, CompactorRole)

Round2 补充修复:
- fail-on-missing 反作弊门禁
- projection-store-apply.test.ts 补写
- 3个空壳测试转行为 (evidence-store, recovery-impl, knowledge-store)
- ask 项目根支持 AIRCODING_PROJECT_ROOT
- Worker 事件契约修复 (task.attempt.started → checkpoint)

Round3-F: cpp 工具切换
- 删除 BuiltInToolRegistrar cpp.* 闭包
- 接入 toolchain-cpp 真实 CppToolRegistrar
- canonical envelope {status/output/metadata}
- ExecutorRole system prompt 对齐新工具名

Round3-H: Doctor 5 类报告
- toolchain (cmake/ninja/cppcheck/clangd/g++)
- display (X11/Wayland + ImageMagick)
- network (internet connectivity)
- provider (api_key/base_url/model/connectivity)

Secret 脱敏:
- 状态交接.md: sk- → \${OPENAI_API_KEY}
- .gitignore: 添加 .air/ .claude/

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/runtime/src/tools/ToolRegistry.ts

@@ -11,6 +11,8 @@ import type { ToolDefinition, ToolCall, ToolResultEnvelope, ISOTimeString } from
 
 import { PermissionEngine, createPermissionEngine, type PermissionContext, type PermissionDecision, type PermissionAction } from '../security/PermissionEngine.js'
 import type { AgentType } from '@aircoding/contracts'
+import { eventIngestor } from '../events/EventIngestor.js'
+import { eventBus, type Subscription } from '../events/EventBus.js'
 
 export type ToolExecutionReturn =
   | ToolResultEnvelope
@@ -47,6 +49,7 @@ export class ToolRegistry {
   private executors: Map<string, ToolExecutor> = new Map()
   private permission_engine: PermissionEngine
   private project_root: string
+  private readonly permission_timeout_ms = 5 * 60 * 1000
 
   constructor(project_root: string) {
     this.project_root = project_root
@@ -263,9 +266,39 @@ export class ToolRegistry {
         }
       }
 
-      case 'ask_user':
-        // Suspend; emit permission.prompt.requested
-        return create_error_result(call.call_id, 'user_prompt_required', 'User confirmation required')
+      case 'ask_user': {
+        const prompt_id = `perm_${crypto.randomUUID()}`
+        await eventIngestor.ingest({
+          id: `evt_${prompt_id}`,
+          type: 'permission.prompt.requested',
+          version: 1,
+          session_id: ctx.session_id,
+          project_id: ctx.project_id,
+          timestamp: new Date().toISOString(),
+          source: { kind: 'tool', id: call.name },
+          route: ['tool_registry', 'permission'],
+          payload: {
+            prompt_id,
+            subject: call.name,
+            risk_level: decision.risk_level,
+            reason: decision.reason,
+            options: ['allow_once', 'deny'],
+            default_option: 'deny',
+            request_ref: { call_id: call.call_id, tool_name: call.name, agent_id: ctx.agent_id },
+          },
+        })
+
+        const selected = await this.wait_for_permission(prompt_id, ctx)
+        if (selected !== 'allow_once' && selected !== 'allow') {
+          return create_error_result(call.call_id, 'permission_denied', `User selected ${selected}`)
+        }
+
+        const executor = this.executors.get(call.name)
+        if (!executor) {
+          return create_error_result(call.call_id, 'executor_not_found', 'Executor not registered')
+        }
+        return this.execute_executor_final(executor, call, ctx)
+      }
 
       case 'deny':
         return create_error_result(call.call_id, 'permission_denied', decision.reason)
@@ -313,6 +346,45 @@ export class ToolRegistry {
     return Boolean(value && typeof (value as any)[Symbol.asyncIterator] === 'function')
   }
 
+  private wait_for_permission(prompt_id: string, ctx: ToolExecutionContext): Promise<string> {
+    return new Promise((resolve) => {
+      let settled = false
+      let subscription: Subscription | undefined
+      const finish = (selected: string) => {
+        if (settled) return
+        settled = true
+        clearTimeout(timeout)
+        if (subscription) eventBus.unsubscribe(subscription)
+        resolve(selected)
+      }
+
+      const timeout = setTimeout(() => {
+        void eventIngestor.ingest({
+          id: `evt_${prompt_id}_timeout`,
+          type: 'permission.prompt.resolved',
+          version: 1,
+          session_id: ctx.session_id,
+          project_id: ctx.project_id,
+          timestamp: new Date().toISOString(),
+          source: { kind: 'tool', id: 'permission_timeout' },
+          route: ['tool_registry', 'permission'],
+          payload: {
+            prompt_id,
+            selected_option: 'deny',
+            decision_id: `decision_${crypto.randomUUID()}`,
+            resolved_by: 'timeout',
+          },
+        }).catch(() => finish('deny'))
+      }, this.permission_timeout_ms)
+
+      subscription = eventBus.subscribe({ session_id: ctx.session_id, types: ['permission.prompt.resolved'] }, (event) => {
+        const payload = event.payload as Record<string, unknown>
+        if (payload.prompt_id !== prompt_id) return
+        finish(String(payload.selected_option || 'deny'))
+      })
+    })
+  }
+
   /**
    * Execute streaming tool.
    */