Provide an opt-in managed-runtime launcher hook for host-controlled process ownership

## Summary

The SDK's managed runtime connections are excellent for most applications: the SDK starts a compatible Copilot runtime, connects to it, and cleans it up automatically.

Some embedding hosts need to retain ownership of the runtime process from the instant it is created. Examples include desktop applications, long-lived services, worker hosts, managed execution environments, and applications with OS-level process containment or resource-governance requirements.

Could the SDK expose an opt-in launcher/lifecycle hook for managed runtime connections?

## Problem

Today an application can choose between two models:

1. Let the SDK launch and own the runtime process.
2. Launch a headless runtime independently and attach through a network connection.

The first model does not give the host a supported way to apply process containment, resource governance, or host-specific lifecycle handling at process creation.

The second model can add deployment and connection-management complexity. A host may also need a stronger way to establish that the runtime it connects to is the exact process it launched, rather than merely a process listening on a local endpoint.

There is no need to change the default SDK behavior. This is an advanced embedding requirement for hosts that already have mature process supervision.

## Proposed capability

Expose an optional factory or lifecycle interface used only when the SDK would otherwise launch a local runtime.

Illustrative Python shape:

```python
from copilot import CopilotClient, RuntimeConnection

def launch_runtime(command, options):
# Host launches the supplied command using its own process supervisor.
# Returns a process/lifecycle handle understood by the SDK.
...

client = CopilotClient(
connection=RuntimeConnection.for_stdio(
runtime_launcher=launch_runtime,
),
)
```

Or, if a lifecycle object is preferable:

```python
class RuntimeProcess:
def wait_ready(self, timeout: float) -> None: ...
def terminate(self, grace_period: float) -> None: ...
def wait(self, timeout: float | None = None) -> int | None: ...
@property
def stdin(self): ...
@property
def stdout(self): ...
@property
def stderr(self): ...

client = CopilotClient(
connection=RuntimeConnection.for_stdio(
runtime_factory=create_runtime_process,
),
)
```

The exact API shape is less important than these properties:

- The host receives the final runtime command and launch options **before** the runtime starts.
- The SDK retains ownership of protocol negotiation, session management, and normal client cleanup.
- The host can apply OS-native containment and observability at process birth.
- Process termination responsibilities are explicit and cannot result in double ownership.
- The default managed-runtime behavior remains unchanged.
- The abstraction works with local stdio first; it should not require an application to expose a TCP listener merely to control child-process ownership.

## Why stdio matters

A host-controlled stdio launcher avoids introducing a network endpoint solely for local embedding. It also keeps the runtime connection bound directly to the process the host created, which simplifies lifecycle, containment, and cleanup reasoning.

## Non-goals

- Changing default SDK startup behavior.
- Requiring applications to implement their own JSON-RPC transport.
- Replacing the SDK's runtime provisioning or compatibility management.
- Adding remote-runtime deployment features.
- Exposing private SDK process internals after startup.

## Questions for maintainers

1. Is there an existing supported extension point for host-owned runtime creation that I may have missed?
2. Would a launcher callback or a small lifecycle protocol be more consistent with the SDK's cross-language design?
3. Should this apply only to stdio transport, or also to SDK-managed TCP and in-process transports?
4. What lifecycle boundary would maintainers want the host to own versus the SDK to own?

I can provide a small implementation proposal once there is agreement on the intended API and cross-language scope.

提议的入口点是 CopilotClient 和 RuntimeConnection.for_stdio；首先跟踪现有的 managed-runtime 启动和清理路径，issue 并未指出这些路径所在的文件。完成的标准是，就具有明确 ownership 语义的 opt-in stdio launcher 或 lifecycle API 达成一致，同时保持默认行为不变，并定义跨语言范围。

由索引模型根据 Issue 内容生成。