refactor(host-kit): move verified-file ownership into host-kit

[thymikee]

Parent: #2129

Blocked by: none. Wave 1; this is the host-file seam required by the app-log child.

Scope — exact tracked files

Production:

• src/utils/verified-file.ts

Tests:

• src/utils/__tests__/verified-file.test.ts
• src/utils/__tests__/atomic-publish-ownership.test.ts

Destination and importer edits

Move the verified descriptor implementation and test to:

• packages/host-kit/src/internal/verified-file.ts
• packages/host-kit/src/internal/verified-file.test.ts

Re-export the named verified-file operations from the existing packages/host-kit/src/file.ts entry; do not add a new package subpath or a root src/utils compatibility export.

Update these exact production importers to @agent-device/host-kit/file:

• src/daemon/app-log.ts
• src/daemon/durable-capture-resource-store.ts
• src/platform-runtime-app-log-output.ts
• src/platform-runtime-app-log-process.ts
• src/platform-runtime-network-host.ts
• src/utils/app-log-files.ts (the app-log policy move is a downstream child)

Move the cross-owner publication test to:

• src/daemon/__tests__/atomic-publish-ownership.test.ts

It remains a daemon publication test that verifies the existing host-kit atomic publisher and the durable-capture exception; it is not a new host-kit production API.

Behavior invariants

Preserve regular-file admission, final-symlink refusal, descriptor identity/race detection, absent-read behavior, append/truncate/create flags, typed COMMAND_FAILED errors, recovery hints, and descriptor ownership/closing. Preserve the durable capture store's specialized fsync/destination checks and all existing atomic-publish call sites. Keep app-log rotation/redaction/path policy out of host-kit.

The host-kit implementation must remain behind its existing file export and use the current kernel AppError contract. No generic filesystem facade, fallback, or relaxed symlink behavior.

Focused validation

Run:

• pnpm vitest run packages/host-kit/src/internal/verified-file.test.ts packages/host-kit/src/internal/host-file.test.ts
• pnpm vitest run src/daemon/__tests__/atomic-publish-ownership.test.ts src/daemon/__tests__/durable-capture-resource.test.ts
• the existing app-log and durable-capture tests that consume the changed export
• pnpm check:affected --run

Planted-red proof

No new structural rule is added. The moved test already contains independent red-capable assertions with literals for the regular-file and concurrent-replacement hints; keep those literals independent from the implementation. Temporarily bypass the post-open identity check and observe the race test fail before restoring it. Do not replace the host-kit file contract with a filename or Node-builtin classification.

Dependency order

Wave 1. The app-log path/rotation child is blocked by this child. The transport, provisioning, command/core, update, Swift, and snapshot children do not depend on this move.

Shrink target

Delete src/utils/verified-file.ts and its utility test. The package implementation must be a move with no duplicate wrapper: production LOC after discounting the physical move must not grow, and the only new package surface is named exports through the already-existing file entry. Relocate, do not duplicate, the publication test.

[thymikee]

Scope addendum from the final tracked-file cross-check:

Also move this exact host-boundary test in this child:

• src/utils/__tests__/exec-boundary-faults.test.ts -> packages/host-kit/src/internal/exec-boundary-faults.test.ts

It exercises the existing @agent-device/host-kit/command executor override and adds no production API. Include it in the focused host-kit test command; the final host test set is verified-file.test.ts, exec-boundary-faults.test.ts, and the relocated atomic-publication ownership test.