In-environment marketplace 'Install' dead-ends (proxy is browse-only → 405); needs delegated install or redirect-to-cloud

[xuyushun441-sys]

Symptom

From inside a tenant ObjectOS runtime, the Setup-app marketplace package page (e.g. https://<env-host>/_console/apps/setup/system/marketplace/<pkg_id>) shows an Install action, but clicking it fails — the user cannot install an app from within their own environment.

Root cause

packages/runtime/src/cloud/marketplace-proxy-plugin.ts deliberately forwards only GET/HEAD to the cloud control plane; any non-GET (the install POST) is rejected:

if (method !== 'GET' && method !== 'HEAD') {
  return c.json({ success:false, error:{ code:'marketplace_method_not_allowed',
    message: 'Marketplace proxy only forwards GET/HEAD; install via cloud.' }}, 405);
}

Rationale in-code: "those would need credentialled cloud auth which the tenant runtime does not carry." So the in-env marketplace is browse-only; installation must happen on the cloud control plane.

Cloud-side install works (verified: POST /api/v1/actions/sys_environment/install_application → 200, "Installed … into environment"). It's specifically the in-environment install path that dead-ends.

Impact

The Setup-app marketplace surfaces an Install affordance that can never succeed on a tenant runtime — every in-env install attempt 405s. This is the natural place a user tries to install (they're already in the environment), so it reads as broken.

Suggested fix (pick one)

1. Delegated install (preferred): have the runtime forward the install to cloud using the env→cloud service credential (OS_CLOUD_API_KEY) plus the acting user's identity, so install works in-place. The proxy comment already anticipates this ("future iteration may introduce a delegated install token").
2. Redirect-to-cloud: make the in-env marketplace Install CTA deep-link to the cloud control-plane install flow (cloud env-detail → Install Application) instead of POSTing to the browse-only proxy — and/or hide the Install button on tenant runtimes so it isn't a dead end.

Either removes the dead-end. framework @ cf03ef2f7 (also current main).