feat: ship single-file run distribution and list key reset

Compile-time run auth replaces zip sidecars, lengthens run keys, revokes
active sessions on reset, and exposes run-key reset in the server list.

platform_web/pages/ServersPage.tsx

@@ -10,6 +10,7 @@ import {
   runtimeBuildStages,
   runtimeDependencyStages,
   runtimeDownloadStages,
+  runtimeKeyResetStages,
   runtimeLogStages,
   runtimeRunBuildStages,
   runtimeUpdateStages,
@@ -271,6 +272,12 @@ export function ServersPage({ session, operations, onNavigate }: PageComponentPr
       openRunTargetSelection(instance);
       return;
     }
+    if (action === "reset-run-key") {
+      const confirmed = typeof window === "undefined" || window.confirm("重置 run 密钥会立刻断开已部署 run，并要求重新生成新的 run 可执行文件。继续？");
+      if (!confirmed) {
+        return;
+      }
+    }
     const defaults = quickRuntimeDefaultsForPlugin(instance.pluginId);
     const intent = quickRuntimeActionLabel(action);
     const operationId = operations.begin({ intent, targetKind: "server", targetId: `${instance.id}:${action}`, requester: session.displayName });
@@ -319,6 +326,10 @@ export function ServersPage({ session, operations, onNavigate }: PageComponentPr
             const update = await platformApiClient.pushRunUpdate(instance.id, runUpdateRequest(instance.id, reference.artifactId, reference.checksum));
             return `run 更新任务已排队，job ${update.jobId ?? update.id}`;
             }
+            if (action === "reset-run-key") {
+            const key = await platformApiClient.resetRunKey(instance.id);
+            return `run 密钥已重置到第 ${key.generation} 代，旧 run 会话已失效，请重新生成并部署 run`;
+            }
             if (action === "dependencies-check") {
             const job = await platformApiClient.checkDependencies(instance.id, dependencyJobRequest(instance.id, defaults.probeKey));
             return `依赖检查任务已排队，job ${job.id}`;
@@ -691,6 +702,7 @@ type ServerQuickRuntimeAction =
   | "generate-run"
   | "download-run"
   | "push-run-update"
+  | "reset-run-key"
   | "generate-client-manager"
   | "dependencies-check"
   | "dependencies-install"
@@ -873,6 +885,17 @@ function ServerCard({ card, metricsPending, metricsUnavailable, canManage, delet
             <section className="runtime-action-group" aria-label="危险操作">
               <span className="runtime-action-group-label">危险操作</span>
               <div className="runtime-action-grid">
+                <button
+                  type="button"
+                  className="runtime-action-item danger-command"
+                  role="menuitem"
+                  disabled={!canManage}
+                  title={canManage ? "重置 run 密钥" : "当前账号没有运行操作权限"}
+                  onClick={() => chooseQuickAction("reset-run-key")}
+                >
+                  <AlertTriangle size={13} />
+                  <span>重置 run 密钥</span>
+                </button>
                 <button
                   type="button"
                   className="runtime-action-item danger-command"
@@ -915,6 +938,8 @@ function quickRuntimeActionLabel(action: ServerQuickRuntimeAction): string {
       return "下载 run";
     case "push-run-update":
       return "更新 run";
+    case "reset-run-key":
+      return "重置 run 密钥";
     case "generate-client-manager":
       return "生成客户端";
     case "dependencies-check":
@@ -941,6 +966,9 @@ function quickRuntimeStages(action: ServerQuickRuntimeAction) {
   if (action === "push-run-update") {
     return runtimeUpdateStages;
   }
+  if (action === "reset-run-key") {
+    return runtimeKeyResetStages;
+  }
   if (action === "dependencies-check" || action === "dependencies-install") {
     return runtimeDependencyStages;
   }
@@ -954,6 +982,9 @@ function quickRuntimeExecuteStageIndex(action: ServerQuickRuntimeAction): number
   if (action === "push-run-update") {
     return 2;
   }
+  if (action === "reset-run-key") {
+    return 2;
+  }
   return 1;
 }