Update all owned auxiliary activations when selecting a new package revision

A normal released Pantry 0.11.156 user installation of the immutable Craft 0.0.423.1 repair updates craft, but leaves all three auxiliary commands activated from old 0.0.423. This blocks complete all-profile delivery acceptance for #265. It is separate from the Linux runtime provider work in #266.

Observed normal command: /Users/chris/.local/bin/pantry install --user craft@0.0.423.1. Its original log reports three pantry:symlink:skip entries, each with owner=craft-native.org, for craft-app-store, craft-webview and craft-webview-app-store. All four installed v0.0.423.1 files independently match the original signed upstream public binaries. The primary activation points to v0.0.423.1; each auxiliary activation still points into v0.0.423. No auxiliary binary was executed and no shim, override or cache was changed to obtain this observation.

Owning call chain on ac5c470:

• packages/zig/src/install/installer.zig:3032 calls public createPackageSymlinks for the selected global package version.
• packages/zig/src/install/symlink.zig:788-817 discovers all actual bin/sbin programs and activates each.
• createBinarySymlinkFromPath, line260, protects any existing target that differs from the new complete executable path. Two versions of the same canonical provider therefore look like a different-provider collision.
• createEnvSymlinks separately replaces metadata-declared programs earlier. Craft metadata declares only craft, explaining why the primary command updates while the discovered auxiliaries do not.

This guard is unchanged between released 0.11.156 source d47576b and 0.11.158 source ac5c470. Existing docs (docs/features/cache-management.md:311-325) distinguish reactivating the same program from retaining another provider. Existing native activation tests cover exact-version reactivation and different providers, but miss same-provider cross-version/build-revision selection. The SDK's normal webview profile returns bare craft-webview, so it continues resolving the old revision even after the normal upgrade succeeds. This does not affect the full-profile headless probe's use of the corrected primary executable.

Acceptance:

• A public createPackageSymlinks filesystem regression activates multiple commands from two managed versions/build revisions of the same canonical provider and reproduces the stale activation before the fix.
• Selecting a new version of the same provider updates all of its owned discovered commands, without editing cached executable bytes or sourceable interface semantics.
• Another canonical provider retains first ownership. Identify the full provider root under the actual install base, excluding only the version directory; do not compare only displayed basenames. Cover nested domains and separate or relocated roots.
• Removing the old version must retain every updated activation. Keep the version-specific uninstall comparison distinct from provider identity during activation.
• Preserve exact-version reactivation, native argv0/resource lookup, relative launcher relocation, sourceable links, collision safety and owned cleanup. No force flags, manual activation rewrites, cache deletion, SDK fallback or alternate installation path.
• Qualify source tests, independent review, normal source publication and canonical patch release, then verify through the normal released installer before closing this issue or parent #265. Old/corrupted 0.0.423 profile activation is not acceptance evidence.

Original installation and read-only source/target proof: /tmp/settlers-native-423-normal-install/corrected-423.1/pantry-install-corrected.log, /tmp/settlers-native-423-normal-install/registry-readonly/auxiliary-activation-observation.json and auxiliary-activation-diagnosis.json (SHA256 d9b3a547ca51a25b2390d1979f1448f58e12f2b180a54bf50175bfdb7d71432f). No focused duplicate was found; #250 is an unrelated cached Git PathAlreadyExists investigation.

The reviewed source fixes are pushed to main and the unchanged canonical bun run release:patch completed successfully as Chris, without coauthors: release159eafe53d8.

• 26754c533c3: resolve domains through the actual public catalog.
• 26931f84482: use the owning executable predicate and release rejected nested program paths.
• 26837de5c9c: refresh every selected provider command across revisions, preserve foreign providers/install roots, and keep newer major aliases when removing an older revision.

Independent review caught and reproduced a further ownership defect before integration: distinct provider command symlinks sharing one physical executable could bypass the canonical owner check. The maintained public fixture changed output from the retained first provider to the second. Managed activation now always checks full provider/program identity, and both shared-leaf foreign-provider/root cases plus the positive same-provider revision case pass. Original failed review and red logs remain retained; no waiver or basename shortcut was used.

Final maintained filesystem suite:17/17 pass. Source TS:858 pass/8 existing skips, types pass, Pickier0errors/307 existing warnings. Both subsequent upstream commits were preserved through normal merges. Final integrated Zig gate:42/42 steps,2014/2030 tests pass,16 existing platform/service skips; current-catalog resolver5tests/27assertions pass. Source/push receipt /tmp/pantry-267-269-268-main-push-receipt.json, SHA256 0d63a7e1adca1f9ebaf63c084da57b66509f3fa35e6a9c2ea17c44f30f5538b2.

Actual source CI, release159CI, Releaser, standalone Zig and deployment gates are pending. This ticket stays open until those gates, actual public payload identities, and normal released-installer all-profile activation are qualified. Final activation uses the ordinary released installer and explicit package selection. Acceptance does not rely on manual shim edits, deleted caches, forced rebuilds or substituted runtimes. The catalog's newer Craft424 is separate from the immutable423.1 revision; final selection will remain explicit.

Framework adoption is now tracked in Stacks3103, with real blocking links to this issue and the application's native foundation.

Closing the owned-command activation leaf. 37de5c9c is included unchanged in release159, with #269 separately committed. Maintained17-case public filesystem acceptance and independent reviews pass. Full provider/program identity preserves other nested providers and install roots, including distinct symlink leaves sharing one executable; newer revision commands/major alias survive removal of an old version. Actual red outputs and the initially rejected review are retained.

Required exact-source159 Main CI41447621606, Releaser41447621136 and Deploy41447621420 all succeeded on eafe53d87d16df291afcce45d8ae6ad7a775d8d9. All14 required source jobs, seven native release builds, actual npm publication/readback and deployment are retained. The separate standalone Zig run was cancelled by normal concurrency after unrelated newer main852a0612; it is explicitly not counted passing. No gate, test or deadline was changed or bypassed.

Independently qualified all7 original public native ZIPs/manifest and actual npm159 payload: tag/source bindings, API sizes/digests, safe members/CRCs, accepted SHA1/SHA512, full1,865-file npm inventory and SLSA payload source/subject/run association. No independent cryptographic Sigstore-chain claim. Qualification /tmp/pantry-159-qualification/qualification-proof.json, SHA2560682e5766fe3e7b1d737f73d018e75ea6e3a1d02ae089d631683c8f1cf247e85.

The normal156self-upgrade selected159. Its actual installed9,040,328-byte DarwinARM64 executable hashes to 597a927c30dc663721e40c9a4f7438aed578520210cb6e28521ecadc5db4439b, exactly the verified public159 member, and reports pantry 0.11.159 (eafe53d87). Then the unchanged ordinary pantry install --user craft@0.0.423.1 completed successfully from the existing cache. All three previously stale auxiliaries now select423.1; the primary remains correctly selected. All4 actual selected Mach-Os equal their original upstream423 signed bytes, pass strict OS signature verification with DeveloperID3JJRNQW6B7/hardened runtime/JIT entitlement, and each normal bare command returns423with exit0.

Normal acceptance /tmp/pantry-159-normal-activation/craft-423.1-normal-installer-acceptance.json, SHA2569cf56f3c0c83083055f9d17fbfba6e92f7001e4524bee444459bc14656436664. No manual shim edits, deleted cache, force flag, PATH overlay, substitute runtime or profile fallback was used. This is signed program delivery/activation acceptance, not native game, replay/persistent-frame, physicalGPU or Gold fidelity acceptance. Linux runtime-provider #266 and downstream framework/application adoption remain separate.