fix(setup)!: bind managed registrations to selected installation

Use one command owner for setup, client writers, Gemini policy and CLI defaults.
Migrate recognized runner registrations with backups and remove runner prewarm.
Retain unknown identities and exercise real offline npm, CLI and MCP workflows.

Fixes #7757

BREAKING CHANGE: managed MCP registrations use the selected absolute runtime
and REA entry script, including package-runner cache paths. Keep that installation
available or restore it before setup; unknown registrations require confirmed
manual repair. Setup no longer returns prewarm or emits its progress events.

Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)

scripts/lib/verify-package-runner-fixture.mjs

@@ -0,0 +1,8 @@
+import { writeFileSync } from "node:fs";
+
+// Keep argument boundaries intact so verifier consumers never parse shell display text.
+writeFileSync(
+  process.env.REA_NPX_LOG,
+  JSON.stringify(process.argv.slice(2)) + "\n",
+);
+process.stdout.write("│ ✓ Cursor: isolated │\n");

scripts/verify-package-environment.mjs

@@ -1,6 +1,6 @@
 import { chmod, mkdir, symlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { supportedClients } from "../dist/application/SupportedClients.js";
 
 /** Create an isolated prefix, fake PATH, client configs, and environment. */
@@ -41,7 +41,7 @@ export async function verifyPackageEnvironment({
   await writeFile(swVers, "#!/bin/sh\necho 14.5\n");
   await writeFile(
     npx,
-    '#!/bin/sh\nprintf "%s\\n" "$*" > "$REA_NPX_LOG"\necho "│ ✓ Cursor: isolated │"\n',
+    '#!/bin/sh\nexec "$REA_VERIFY_NODE" "$REA_VERIFY_NPX_SCRIPT" "$@"\n',
   );
   await writeFile(hopper, "#!/bin/sh\nexit 0\n");
   await Promise.all([
@@ -98,6 +98,10 @@ export async function verifyPackageEnvironment({
     REA_ANALYSIS_PROVIDER: "auto",
     ...packageHopperEnvironment(root),
     REA_NPX_LOG: npxLog,
+    REA_VERIFY_NODE: process.execPath,
+    REA_VERIFY_NPX_SCRIPT: fileURLToPath(
+      new URL("./lib/verify-package-runner-fixture.mjs", import.meta.url),
+    ),
     REA_REFERENCE_SECRET_PATTERNS_JSON: JSON.stringify([".env"]),
   };
   return {

scripts/verify-package-setup.mjs

@@ -1,3 +1,4 @@
+import { deepStrictEqual } from "node:assert";
 import {
   lstat,
   mkdir,
@@ -11,6 +12,7 @@ import {
 import { dirname, isAbsolute, join } from "node:path";
 import { parse as parseToml } from "smol-toml";
 
+import { clientRegistrationCommandText } from "../dist/cli/clientRegistrationCommandText.js";
 import { TOOL_CONTRACTS } from "../dist/contracts/toolContracts.js";
 import { PRODUCT_IDENTITY } from "../dist/identity.js";
 import { pathExists } from "./lib/verify-package-core.mjs";
@@ -50,12 +52,29 @@ const isDirectRegistration = async (command, cli) =>
   (await realpath(command[0])) === (await realpath(process.execPath)) &&
   (await realpath(command[1])) === (await realpath(cli));
 
-const verifyMcpAdd = async ({ commands, cli, environment, npxLog }) => {
+const verifyMcpAdd = async ({ commands, cli, environment, npxLog, home }) => {
   await commands.run(cli, ["mcp", "add"], environment);
-  const mcpRegistration = await readFile(npxLog, "utf8");
-  const expected = `add-mcp npx -y ${PRODUCT_IDENTITY.registrationPackageSpecifier} mcp --name rea`;
-  if (!mcpRegistration.includes(expected))
-    throw new Error("Incur mcp add did not register the pinned npx command");
+  const settings = JSON.parse(
+    await readFile(join(home, ".config", "amp", "settings.json"), "utf8"),
+  );
+  const registration = settings?.["amp.mcpServers"]?.rea;
+  if (!Array.isArray(registration?.args))
+    throw new Error("Incur mcp add did not write the native Amp registration");
+  const command = [registration.command, ...registration.args];
+  if (!(await isDirectRegistration(command, cli)))
+    throw new Error(
+      "Incur mcp add did not register the selected absolute runtime and REA script",
+    );
+  // Amp consumes the same command through Incur's parser. Check the delegated
+  // helper receives that command as one argument, without flattening its argv.
+  deepStrictEqual(JSON.parse(await readFile(npxLog, "utf8")), [
+    "add-mcp",
+    clientRegistrationCommandText(command),
+    "--name",
+    "rea",
+    "-y",
+    "-g",
+  ]);
 };
 
 const verifySetupPlan = async ({
@@ -588,7 +607,7 @@ export async function verifyPackageSetup({
   hopperSetupSupported,
   root,
 }) {
-  await verifyMcpAdd({ commands, cli, environment, npxLog });
+  await verifyMcpAdd({ commands, cli, environment, npxLog, home });
   const skillPath = join(
     home,
     ".agents/skills/reverse-engineer-anything/SKILL.md",