M6: Multi-endpoint orchestration (hub-and-spoke)

[DeadWaveWave]

💡 Change Scope

• Small Change: Fast feedback, localized UI/logic, low-risk.
• Large Change: New feature, cross-boundary logic, runtime-risk (persistence, IPC, lifecycle, recovery).

📝 What Does This PR Do?

Implements Milestone 6 (Phase 4.2): multi-endpoint orchestration (hub-and-spoke).

• Durable endpoint registry + mounts on Home Worker (secrets stored privately; tokens never returned)
• Mount-aware filesystem routing via filesystem.*InMount (routes mountId -> endpointId)
• PTY data-plane proxy v0: client attaches only to Home /pty, Home proxies to spoke /pty
• New control-surface ops: endpoint.*, mount.*, mountTarget.resolve, filesystem.*InMount, pty.spawnInMount
• Minimal CLI surface for endpoint/mount management and mount-aware FS + PTY
• Contract tests: secret non-leak, routing correctness, remote offline errors, PTY proxy

Spec reference: .opencove/spec/canvas-first-ai-os-v3/18-milestone-6-multi-endpoint-orchestration-spec.md

Demo (CLI):

• opencove endpoint register --hostname <host> --port <port> --remote-token <token>
• opencove mount create --space <spaceId> --endpoint-id <endpointId> --root-path <path>
• opencove fs read-in-mount --mount <mountId> --uri file:///...
• opencove pty spawn-in-mount --mount <mountId> then opencove pty attach --session <homeSessionId>

---

🏗️ Large Change Spec (Required if "Large Change" is checked)

1. Context & Business Logic

• Allow a single client/canvas to operate on multiple execution locations (local + one/many remote workers).
• Keep a single durable truth owner (Home Worker) and route all endpoint-aware operations through it.

2. State Ownership & Invariants

• Home Worker owns durable topology facts (endpoints, mounts) and routes all operations.
• Credentials are never part of sync state/snapshots; tokens are stored in Home private userData files.
• Routing is explicit and explainable: mountId resolves to endpointId before executing.
• Filesystem operations are mount-root contained (file URIs must stay within rootUri).

3. Verification Plan & Regression Layer

• Contract tests (control-surface): secret non-leak, route correctness, offline errors, PTY proxy.
• Unit tests: updated where endpoint ref shape changed.
• Ultimate gatekeeper: pnpm pre-commit.

---

✅ Delivery & Compliance Checklist

• My code passes the ultimate gatekeeper: pnpm pre-commit is completely green.
• I have included new tests to lock down the behavior (or explicitly stated why it's untestable).
• I have strictly adhered to the DEVELOPMENT.md architectural boundaries.
• I have attached a screenshot or screen recording (if this touches the UI). (N/A)
• I have updated the documentation accordingly (if adding a feature or changing a contract).

📸 Screenshots / Visual Evidence

N/A (control-surface + CLI + tests only).

[DeadWaveWave]

Superseded by #159, which includes the updated multi-endpoint orchestration + desktop endpoints/mounts work. Closing to keep M6 delivered as a single PR.