Record installed runtime update ownership

[jezdez]

Outcome

Let one canonical update-capable conda-ship executable be installed with direct or external ownership without restamping, deriving, or rebuilding it.

The executable stamp describes update capability and source identity. The existing .<runtime>.json record describes the installed ownership, installation kind, stable executable path, and optional external update instruction.

The implementation landed in PR #94. Standalone installer adoption landed in jezdez/conda-runtime#16. Delivery-specific package-manager integrations remain tracked in jezdez/conda-runtime#15. Constructor support is deferred in conda/constructor#1299 until a concrete distribution needs it.

Scope

• Add v1/record-installation to the existing local JSON helper contract
• Bootstrap the runtime record when needed, acquire its lock inside the helper, and never delegate the helper action
• Permit only a one-way direct-to-external ownership change
• Preserve runtime identity, platform, and update source while accepting version changes only from a valid stamped replacement
• Let direct-to-external classification set the installation kind, stable path, and external instruction once, then preserve them
• Preserve installed ownership and classification when reconciling a valid externally replaced executable
• Make cs package-update validate stamped update capability rather than current installed ownership
• Reject ownership and instruction as new build settings while retaining read compatibility with 0.6.x stamps
• Keep the same canonical executable usable by standalone installers and external package managers
• Add no metadata file, package-manager detector, wrapper, daemon, or service
• Preserve behavior for update-disabled runtimes, non-conda delegates, and Fleet-owned executables

Acceptance

• Direct and external installations use identical executable bytes
• A direct installer can record direct ownership and its stable executable path
• An external package manager can change a direct installation to external ownership exactly once
• External ownership cannot change back to direct ownership
• External installation kind, path, and instruction cannot be changed after classification
• Source continuity and stamped runtime identity remain enforced
• Interrupted or external executable replacement preserves the installed ownership record
• New builds reject ownership and instruction, while existing 0.6.x stamps remain readable
• Existing update-disabled, non-conda, and Fleet behavior remains unchanged