feat: add runtime app commands

[thymikee]

Summary

Add Phase 1 runtime app lifecycle commands after #412:

• introduce typed device.apps.open, close, list, state, push, and triggerEvent
• add backend primitives and public type exports for app lifecycle, state, push inputs, and app events
• route the new commands through commands, bindCommands(), and createCommandRouter()
• add app conformance coverage plus runtime tests for backend calls, policy-gated push file inputs, missing push input, non-serializable JSON payloads, toJSON() edge cases, and payload size limits
• document runtime command stability/versioning rules and update COMMAND_OWNERSHIP.md

Touched files: 14. Scope stayed within the runtime command/API, conformance, and docs follow-up to #412; daemon handler migration is intentionally deferred.

Follow-up work

Next PR should wire existing daemon/platform semantics onto these runtime APIs:

• add platform backend adapter implementations for openApp, closeApp, listApps, getAppState, pushFile, and triggerAppEvent
• move daemon open, close, apps, appstate, push, and trigger-app-event compatibility paths to call the runtime where session/device resolution already exists
• add daemon compatibility tests proving CLI/daemon responses stay stable while using runtime app commands internally
• decide whether apps.state should support a session foreground-app fallback or remain explicit app only
• align hosted/cloud policy tests for apps.push artifact inputs and restricted local path behavior
• evaluate whether BackendOpenTarget should become a stricter discriminated union once cloud adapter usage is known

Validation

• pnpm format
• pnpm check:quick
• pnpm check:unit

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://callstackincubator.github.io/agent-device/pr-preview/pr-414/
Built to branch gh-pages at 2026-04-16 12:31 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a4b844437f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject undefined JSON serialization results

stringifyJsonObject() assumes JSON.stringify(payload) always returns a string, but for objects with a custom toJSON() that returns undefined, it returns undefined instead of throwing. In this path, apps.triggerEvent will later call Buffer.byteLength on undefined and throw a raw TypeError, and apps.push will incorrectly accept a payload that is not valid JSON object output. Please treat non-string stringify results as INVALID_ARGS so payload validation remains deterministic.

Useful? React with 👍 / 👎.