Implement external Artifact providers in Harness Studio

Traceability

• Spec ID: studio-external-artifact-provider-runtime
• Status: Implemented
• ADR: Harness Studio Artifact runtime and provider architecture

Intent

Implement the immediately actionable provider migration from ADR-0007 without expanding its evidence-bounded future lanes. Harness Studio should resolve built-in and third-party Artifact capabilities through one server composition root, mount hosted output through one generic surface protocol, and treat Qoder Canvas and GPT Walnut as external providers with honest receipts, activation, support, and trust boundaries.

Qoder keeps its V2 browser wire compatibility while losing its special fields inside the common plugin binding. Walnut becomes observable as a receipt-verified, locally derived provider with zero contributions; no private Walnut invocation is inferred or executed.

Acceptance Scenarios

• AC-1: The common server contract exposes plugin bindings, surface bindings, provider bindings, external providers, contributions, receipts, and hosted-runtime operations without importing CanvasViewer. One immutable composition root resolves an Artifact; common callers no longer pass qoderCanvasViewers or read qoderViewer.
• AC-2: Authored TSX/JSX runtimes resolve before every external lane and cannot be claimed by a Provider. SVG and Mermaid remain Studio-owned defaults, but an explicitly activated, fingerprint-bound external override may replace their virtual runtimes. Eligible data formats resolve in the order external override, Studio built-in, external fallback, unavailable. Same-lane conflicts fail closed rather than using discovery order.
• AC-3: Each ready Qoder viewer is translated into a receipt-covered external provider contribution. Its fingerprint covers the normalized manifest, renderer, optional sidecar, relevant static resources, and selected Canvas SDK/runtime assets. The binding reports adapterExecutionProfile: trusted-local-process, contribution support experimental-local, and hosted surface security profile opaque-web-v1.
• AC-4: Qoder provider migration preserves V2 renderer.type: qoder-canvas, payload.kind: qoder-canvas/v1, and