fix(desktop): separate WSL onboarding from shared Host update and interruption consent

Parent tracking issue: #5143

### What happened

Released Desktop WSL onboarding unconditionally passes `--update-existing`. When the default root already has a different exact package, setup enters replacement and derives `allowInterruptActiveTasks: true` from that flag. The user-facing action is “Connect”; it does not separately authorize replacing a shared Host or interrupting another surface's work.

Ordinary connection of an existing profile uses the installed `operator connect` and is a different path. The defect is re-onboarding/discovering an already deployed environment, not every reconnect.

### How to reproduce

1. Provision a WSL on-demand Host with package A and retain its State Root. Another Desktop/TUI may be connected.
2. Use a Desktop whose setup package is B and choose Add WSL environment for the same distribution.
3. Inspect the generated setup invocation: it includes `--update-existing` without separate update/interruption consent.
4. With a different package, setup forwards interruption permission to lifecycle replacement. If the old Host is running and incompatible, the retirement path can instead fail with `Runtime Host cannot prepare for retirement: incompatible`; if it is stopped, the writer-lock gate can be acquired.

Steps 3–4 are established by code/artifact inspection and an isolated retirement-boundary reproduction, not by interrupting live user work. The user's exact click before the retirement error remains unconfirmed.

### Environment

- Windows Desktop installed artifact inspected: `0.2.0-dev.25.20260908`.
- WSL Ubuntu, Linux x64, kernel `6.6.87.2-microsoft-standard-WSL2`.
- Managed Host: `0.2.0-dev-fe229269f0df`, epoch 121; newer clients observed at epochs 133/136.
- Relevant source rechecked at `f09119884e3e640f1c10755da19a583416aed19f`.

### Logs, screenshots, or additional context

- [Unconditional WSL flag](https://github.com/apache/maka/blob/f09119884e3e640f1c10755da19a583416aed19f/apps/desktop/src/main/runtime-host-wsl-controller.ts)
- [Setup derives interruption permission](https://github.com/apache/maka/blob/f09119884e3e640f1c10755da19a583416aed19f/packages/cli/src/runtime-host-setup-command.ts)
- Existing `runtime-host-setup.test.ts` explicitly expects replacement interruption permission to be true. That assertion is not evidence of appropriate UI consent.
- #4064 promises daily connection through the persisted operator; #3591 separates manual updates. SSH development-archive setup intentionally has a replacement shortcut, whereas released SSH setup does not add this flag. Preserve that distinction rather than imposing released UX on source development.

### Expected behavior / acceptance

- Discover and reuse an existing compatible deployment without replacing its package or changing lifecycle configuration merely to attach a client.
- First install remains explicit. Existing incompatible deployment offers maintenance/client guidance without mutating it.
- Repeated onboarding is idempotent; recognizing an existing profile after setup is too late to prevent package mutation.
- Replace unconditional released WSL update authorization with an explicit maintenance choice. Update permission must not implicitly grant interruption permission.
- Never downgrade an existing Host to match an older Desktop, including when the Host is stopped.
- Retain an explicit development-artifact replacement path for source workflows, but do not bypass ownership, epoch or active-work checks.
- Regression coverage: absent/existing deployment; same/different package; running/stopped Host; idle/active second surface; newer Host + older Desktop; repeated setup; rejected/cancelled maintenance leaves the deployment unchanged before commit.

简体中文

发布版 Desktop 添加 WSL 时固定传入 `--update-existing`，setup 又把已有部署换包解释为允许中断活动任务。用户点击“连接”不能等同于授权替换共享 Host 和中断 TUI。应先识别已有部署，兼容就复用；不兼容给明确维护入口。禁止为匹配旧 Desktop 降级 Host。源码开发可保留明确的开发包替换快捷路径，但不能绕过协议、所有权和活动保护。现场 retirement 报错前的具体点击尚未确认，不把可达路径冒充完整现场复现。

AI disclosure: OpenAI Codex investigated and drafted/submitted this issue at the user's explicit request.