Record runtime reuse and probe the offline isolation deployment boundary #221

P0 follow-up to the refreshed #198, before enabling a live OpenCode participant. Related to #216/#218 and deterministic fixture #219/#220.

Acceptance:

• Audit pinned DSH 0.2.0-rc.2 / commit 639ed015397290b3745d163aafe02ffee4aa3f84 Cordis lifecycle, subagent providers and sandbox guarantees; document what FlyBot reuses and what remains missing for multi-turn room participants.
• Keep ParticipantDriver a thin room boundary. Do not add another plugin/service registry, task state machine or scheduler. Distinguish one-shot ACP/Codex/Claude Code/DSH SDK providers from continuable in-process providers and avoid treating capability presence as authorization.
• Specify an offline deployment boundary for separate Writer and verifier writable areas, controlled artifact handoff, no ambient credentials/network, explicit process/resource ownership and cleanup. Distinguish proposed policy, configured limits and observed enforcement.
• Add an explicit opt-in synthetic isolation probe for the selected backend, using a pinned image and disposable resources only. Check own writes, denied peer/private reads, denied out-of-workspace writes, network denial and selected resource configuration; retain safe structured evidence and clean up. No DSH/OpenCode/model execution, credentials, privileged containers, host-wide mounts or paid calls.
• Report untested/partial boundaries honestly; the probe is not completion of runtime integration or a general security certification. Keep [RFC] 跨运行时 Agent 对话与协作：以 OpenCode 为首个试点的目标、需求与两种方案 #198 open.