Keep Walnut bootstrap paths portable

Traceability

• Spec ID: walnut-cross-platform-paths
• Status: Implemented

Intent

Make the Studio-private Walnut bootstrap behave consistently on Windows, macOS, and Linux. Runtime asset references stored in receipts must not depend on the host path separator, and cache-root derivation must follow the requested platform rather than the platform running the test.

Acceptance Scenarios

• AC-1: A synthetic Walnut runtime can be probed, installed, and verified on Windows without its receipt being rejected as an invalid runtime asset set.
• AC-2: Runtime asset sourcePath and relativePath values use stable ASAR / separators on every host, while filesystem access resolves those values safely beneath the local Studio cache.
• AC-3: Cache-root derivation returns native Darwin, Linux, and Windows paths for the explicitly requested platform, independent of the test host.
• AC-4: Tampering with an installed runtime asset still produces the existing failed-verification result.

Non-goals

• Enabling Walnut discovery from non-macOS ChatGPT installations.
• Changing the experimental-local support level, consent flow, asset roles, or cache ownership.
• Changing artifact viewer behavior or the broader Studio artifact model.

Plan and Tasks

1. Use POSIX path semantics for paths originating in the ASAR index and stored in provider receipts.
2. Select POSIX or Windows path semantics from the requested platform when deriving a default cache root.
3. Tighten the focused tests around portable receipt paths and exact platform-specific cache roots.

Test and Review Evidence

• AC-1/AC-2/AC-4: focused Walnut bootstrap tests passed 8/8 on macOS, including install/verify, portable receipt paths, tamper detection, and removal. A Windows CI rerun remains pending until the change is committed and pushed.
• AC-3: the focused test asserts exact Darwin, Linux, and Windows cache-root results without branching on the host platform.
• Package evidence: Studio typecheck passed; the full package build and test run passed 141/141 tests across 21 files.
• Documentation evidence: the Markdown link graph passed 6/6 after regeneration; the generated graph remained unchanged.
• Diff evidence: git diff --check passed for the tracked Walnut source and test, and the new spec has no trailing whitespace. Existing artifact-viewer worktree changes remain outside this maintenance diff.

Risks

• Receipt compatibility: existing macOS receipts already use /, so keeping that representation stable avoids a migration.
• Path containment: portable receipt paths still pass through the existing local resolve-based confinement check before filesystem access.