Complete release delivery and confirm self-hosted connections

[SaladDay]

Self-hosted installation now waits for Core to confirm the exact Environment connection using the restricted executor credential. Failures have a total deadline and actionable retry guidance; retries retain the original container and history. Remote Runtime uses the public WebSocket origin, while an authenticated allocation binding keeps embedded managed Runtime on its reachable internal route.

The release workflow builds matched prebuilt Core/Web, node and V1 Runtime assets, propagates input-resolution failures and reserves enough runner disk space. The manifest verifies both config and OCI image identities; one shared installer resolver selects the actual immutable local image ID. Default installation remains Core + Web + database, zero nodes, with no Runtime import.

Validation:

• Actual production CI and all 12 downloaded assets passed source/tree, archive, image/layer identity and checksum verification: https://github.com/MiniMax-AI/parsar-core/actions/runs/35905814517. Qualified source: 2cc7ce2.
• Real mx1/mx2 acceptance passed: default zero-node installation and HTTPS authentication; online self-hosted installation/retry; exact credential rejection/revocation; network timeout and database-outage recovery preserving original Runtime and file/artifact content; remote Docker and microsandbox node installation/readiness/retry; Codex/Kimi native execution with Files/Artifacts through self-hosted and both providers; pinned SDK 3.13.0 queries; embedded Docker/microsandbox bootstrap through the internal route with zero Turns.
• 103 installer tests passed locally and on Linux; 12 manifest tests passed. Isolated PostgreSQL binding/auth tests, complete gateway/server tests, sqlc regeneration and OpenAPI generation/drift passed. Fresh independent Astra high reviews covered the whole diff; their in-scope findings were fixed. The final two-file URL-parser correction was self-reviewed and passed the full installer suite.
• Full server make -k check on20f (identical Go/native code to2cc) passed all gates except four pre-existing Dashboard browser cases:123/127, WEB-TEST-002; Store266.789s. The final Python correction passed separately on Linux. Do not describe the full gate as all-green.

Scope and limits: repository visibility remains Internal; acceptance operators handled authenticated asset retrieval, with a recorded test manifest copy changing only artifact_base_url to console hosting. Original release bytes remained unchanged, and no GitHub credentials or test CA enter product. Quick Tunnel acceptance excludes SSE. Untouched harness lifecycle behavior reuses prior qualification rather than claiming a new full three-harness matrix. Microsandbox's existing short Runtime-home requirement rejected an overlong test HOME before enrollment; the successful run used a dedicated short-home account. This usability limit is recorded as LANDING-004-L1, without widening this batch. Original failed test assumptions and recovery evidence were retained. Only this batch's resources and temporary model-secret copies were cleaned.