[jefft72]

Summary

Adds the typed cloud control-plane client and immutable runtime image release path for hosted Diffex sessions. Clients can create, list, inspect, attach to, stop, and delete sessions, while each connection obtains a fresh one-time attachment URL and validates the returned native protocol version.

Reasoning

REST lifecycle operations and the native WebSocket protocol have separate trust boundaries. The client therefore validates strict response shapes, requires HTTPS and WSS outside explicit loopback development hosts, and rejects protocol mismatches before streaming so browser bearer credentials and one-time tickets cannot leak through configuration drift.

Changes

• Adds typed bearer-authenticated cloud session lifecycle methods
• Requests a fresh one-time attachment URL for every WebSocket connection
• Enforces native protocol version compatibility
• Rejects cleartext API and attachment URLs outside localhost
• Adds the AMD64 hosted runtime Dockerfile and minimal build context
• Copies the root TypeScript configuration required by workspace image builds
• Adds immutable SHA-tagged GHCR publishing with provenance and an SBOM
• Documents the Daytona snapshot handoff

Testing

• npm run hydrate:model-data
• npm run build:offline
• npm run check
• npm run test --workspace @earendil-works/diffex-client - 41 tests passed
• npm audit --audit-level=high - zero vulnerabilities
• GitHub CI build-check-test - passed
• GitHub Runtime Image build - passed