feat: make first-run home selection and network recovery predictable

[Sunrisepeak]

Cold diagnostic and configuration queries could initialize the private registry and wait for downloads before reporting a network problem or accepting a mirror change. This separates configuration reads, local initialization and capability bootstrap. Environment/configuration queries, toolchain listing and doctor do not acquire tools.

self init --home <path> initializes and remembers the effective home through one locator under the original home. Original selection retains MCPP_HOME, portable installation and user-directory precedence; only one hop is followed. Explicit --force --home preserves both data trees. Bare --force retains its existing reset semantics and names the target when redirected. Config and doctor report retained old data. The Windows-only first interactive initialization offers two choices, including an Enter default, with cancellation and no prompt for noninteractive, explicit or portable homes.

Initialization probes actual provider resources before the first possible network operation. Doctor shares the same five-second discovery/probe budget and skips it offline. Downloads expose the actual source and candidate attempt, use an eight-second connect cap and thirty-second byte-idle protection, and retain the existing index and final-install budgets. Cancellation owns the child process tree; heartbeat output cannot renew byte progress, and a network failure is not repeated through another install frontend.

The pinned provider is xlings 2026.10.19.1 (openxlings/xlings#684). Metadata is read with a deadline in a temporary home and working directory. Status queries against custom older providers are skipped when the read-only guarantee is absent. Installed toolchains remain usable without acquiring a provider. The bilingual manual, machine-output reference, SPEC-010 and release notes describe these boundaries.

Closes #822.

Validation:

• Home parsing/transactions: 16 local unit cases and actual CLI persistence, Unicode/relative paths, env/portable isolation, concurrent publication, write-fault retention and force data boundaries.
• Provider integration: 9 network/process cases, 70 xlings integration cases and 16 package-fetcher cases passed locally. Actual old-provider and HTTP/TLS/offline doctor checks preserve the selected home and caller project.
• Windows native console: the formal final-head job 117938043817 passed the complete native menu, unit/integration suite, package and smoke checks. Its dedicated legacy-ACP home run passed all 16 cases, including the Unicode locator case with an actual [ OK ] result. Logs: https://github.com/mcpp-community/mcpp/actions/runs/39214916663/job/117938043817
• Full CI: 71 checks succeeded and 2 conditional checks skipped at final head 737d2fcec2e145375f7a5b77f875f19983718c22. Main run 39214916663, ARM64 fresh install 39214916512 and Windows CRT 39214916640 all completed successfully.
• Provider boundary, module wiring, version pins, workflow assertions, and documentation checks passed.

Final review: completed after all final-head CI checks passed; no blocking findings. Architecture, transaction/cancellation stability, simplicity, UX, compatibility/upgrade continuity, platform bindings and en/zh documentation were checked against the final implementation and logs. Explicit force-home preserves data; ordinary queries remain local; the provider owns all transport facts. Published-resource and ecosystem closure follow merge.

The separately reproduced header-import mapping defect (#816) and benchmark ratio assertion remain outside this feature. Their evidence and implementation boundaries are recorded in the design document; the temporary observation PR #823 is not merged.

Upstream prerequisites are complete: xlings#684 is merged and released, all 24 GitCode assets were downloaded and SHA256-verified, and xim-pkgindex#1002 is merged. Two separate installed clients resolved and downloaded both exact and latest xlings 2026.10.19.1 through the propagated official index. The mcpp bootstrap pin remains on its existing released version until post-release closure.