feat(agents-api): initialize isolated system packages for native tools

[SaladDay]

Result

Saved Environment Templates and inline hosted Sessions can initialize packages.system alongside npm/Python packages and ordered setup. Core resolves and freezes configuration once; the shared Runtime initializer runs real apt/dpkg. Native Codex, Claude Code and MiniMax Code shell tools use the installed dependencies without adding harness or Provider branches to template business logic.

The immutable tool-root seed is built before Runtime/harness code or credentials enter the image. Package scripts run under the unprivileged Runtime identity in a separate filesystem/process view; later native access is read-only. Existing adapters retain execution and cancellation ownership. E2B bootstrap restores the new launcher's required mode after cloud finalization.

Repeated E2B cold-start failures also require increasing the existing shared CLI
availability budget from 5 to 15 seconds. There is no new retry, warmup or Provider-specific startup path.

Validation

• make check, focused API/Store/execution and adapter checks, Claude TypeScript/workspace tests, and generated OpenAPI passed on zju_a100_2 with a dedicated execution database.
• Actual Kimi/MiniMax APIs, fixed Python SDK 3.13.0 and raw HTTP passed standalone Docker acceptance for all three harnesses. Codex covered template and inline paths; Claude and MiniMax covered templates through the shared initializer.
• Verified actual jq/compiler/libpq and npm/Python dependencies, setup/native visibility, immutable tool roots, credential/Skill protection, Files/Artifacts, cancellation with observed child cleanup, and Core/Runtime restart preserving workspace and owned native history without setup replay.
• Codex/E2B passed real Kimi template and inline acceptance in 576.41s, then the final rebuilt tool-root image passed in 457.91s. The latter verifies native default/subdirectory cwd through public command Items and actual effects, plus artifact permissions, credential/history/process/envd isolation, disabled tool networking, public cancellation, Core/Runtime crashes, preserved files/history and no input/initialization replay. Cleanup reported no errors.
• The final mount correction also passed real Docker initialization/cwd/isolation checks (106.30s). The two complete make check runs precede this mount-only correction; changed Python source and the affected actual paths were rechecked.
• Fresh independent GPT-6 Astra high whole-diff review: no actionable findings. One default-cwd issue from the earlier review was fixed and independently re-reviewed after actual regression.

Single-UID/service-account limitations, unqualified PTY behavior and retained failed attempts are documented. This is bounded system-package support, not full Template or Agents API compatibility. No product implementation or product-specific regression is included.