feat(runner): install stage with progress events

Install stage: package-manager detection (lockfile beats the
packageManager field, npm default — vite-kitchen's shape), install run
inside the clone with staged status heartbeats, and every failure —
including install-before-clone — mapped to the named install-failed
cause with a bounded output tail. The spawned-runner suite now runs the
full clone → install pipeline on the daemon-served vite-kitchen (real
npm registry install) and greps the child's entire stdout+stderr plus
the clone's .git/config for the PAT and workspace token. Shared test
doubles extracted (exec.mock.ts, tests/runner-session.ts) to keep the
suites duplication-free.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

apps/runner/AGENTS.md

@@ -63,6 +63,25 @@ What is NOT covered: a real smart-HTTP provider (GitHub et al.) — the
 dumb-HTTP fallback exercises the same credential machinery in git, but
 the smart-protocol surface itself first meets reality in later PRDs.
 
+## Install stage
+
+- Package-manager detection (`src/stages/install.ts`): lockfile first
+  (pnpm-lock.yaml / yarn.lock / bun.lockb / bun.lock /
+  package-lock.json / npm-shrinkwrap.json — the lockfile pins install
+  semantics, so it beats a contradicting `packageManager` field), then
+  the `packageManager` field, then npm as the default (vite-kitchen's
+  shape: no lockfile, no field).
+- The detected manager runs `install` in the clone (`npm` adds
+  `--no-audit --no-fund`), streaming staged `status` heartbeats; every
+  failure — including "install before clone" — is the named
+  `install-failed` cause with a bounded output tail as the message.
+- The in-process integration suite covers success on a minimal
+  no-dependency fixture (real npm, instant, offline) and the named
+  failure via a fixture depending on a package that cannot exist; the
+  spawned-runner suite runs the full clone → install pipeline on
+  vite-kitchen (real registry install) with the leak grep over the
+  child's entire output.
+
 ## Testing
 
 - Unit suites live next to sources in `src/`; protocol/WS suites live in