feat(process): honor entry-declared security config on process start

[wolfy-j]

Problem

Lua process entries currently discard their security: block. Functions and supervised services already apply intrinsic entry security through WithSecurityConfig; processes are the remaining executable entry type that cannot declare an actor or policy scope.

Change

• Add Security *security.Config to source and bytecode process configs and to process factory metadata.
• Preserve the typed config through add, update, and invalidation factory registration.
• Apply it to the prepared process frame before standard or terminal hosts submit the process to the scheduler.

Semantics

This uses the existing function-entry contract and resolver:

• data.security is intrinsic to the process and applies to every launch path.
• A declared actor replaces an inherited or launch-provided actor; omitting the actor preserves the inherited actor.
• Declared policies and groups merge with the inherited or launch-provided scope.
• No security declaration is a no-op.

This is distinct from PR #558: meta.command.security is a trusted CLI-launch overlay, while this PR provides the process entry’s intrinsic security. Combined-tree tests verify that launch scope is preserved, intrinsic policy scope is merged, and the intrinsic actor wins. Once #558 lands, both paths resolve through the same system/security.ResolveConfigPairs implementation.

Verification

• Full repository tests pass.
• Targeted race tests pass for both process hosts, process registration, and config APIs.
• Targeted lint and Windows vet pass.
• Standard-host tests cover actor precedence and policy union with launch context.
• Terminal-host tests cover intrinsic security application.
• Factory registration tests cover typed config propagation.
• The combined feat(process): honor entry-declared security config on process start #555 + feat(cmd): launch terminal commands under entry-declared security context #558 tree passes targeted normal and race suites.

[Copilot]

Pull request overview

This PR ensures entry-declared security: configuration for process entries is preserved and applied at process start, bringing process behavior in line with functions and supervised services.

Changes:

• Extends process metadata (process.Meta) and Lua process entry configs to carry Security *security.Config.
• Threads parsed security config through the Lua process component factory registration so hosts can access it.
• Applies WithSecurityConfig to the process frame context in both service/host and service/terminal, and adds a host-level test covering actor + policy application.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
service/terminal/host.go	Applies entry-declared security config to terminal-launched process frame contexts before scheduling.
service/host/host.go	Applies entry-declared security config to standard host process frame contexts before scheduling.
service/host/host_test.go	Adds test asserting entry security actor + policies are visible/evaluable in the process frame context.
runtime/lua/component/process/manager.go	Propagates parsed Security from Lua process configs into FactoryEntry.Meta during factory registration/updates/invalidation.
runtime/lua/component/process/manager_test.go	Updates test helper call signature for registerFactory to include the new security parameter.
api/runtime/lua/config.go	Adds security field to ProcessConfig and BytecodeProcessConfig to support security: blocks in manifests.
api/process/process.go	Extends process.Meta to include Security *security.Config so hosts can apply it at start.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.