refactor(app-log): move path and rotation policy to daemon ownership

[thymikee]

Parent: #2129

Blocked by: #2136. Wave 2; it consumes the verified-file export owned by the host-kit child.

Scope — exact tracked files

Production:

• src/utils/app-log-files.ts
• src/utils/managed-session-artifact-path.ts

Tests:

• src/utils/__tests__/app-log-files.test.ts
• src/utils/managed-session-artifact-path.test.ts

Destination and importer edits

Move the production policy modules to:

• src/daemon/app-log-files.ts
• src/daemon/managed-session-artifact-path.ts

Move their tests to:

• src/daemon/__tests__/app-log-files.test.ts
• src/daemon/__tests__/managed-session-artifact-path.test.ts

Update exactly these production importers:

• src/daemon/app-log.ts
• src/platform-runtime-app-log-output.ts
• src/platform-runtime-app-log-process.ts

Use the host-kit file entry from #2136 for verified descriptors. Do not move app-log policy into host-kit and do not fold these functions into a generic path/filesystem module.

Behavior invariants

Preserve app-log directory creation, max-size/max-file environment parsing, rotation order and retention, regular-file/symlink protections, append semantics, and all existing error behavior. Preserve session-root realpath confinement, lexical basename checks, symlinked-parent handling, aliases for the same verified root, and exact recovery/error messages. App-log redaction, line buffering, process-marker ownership, and provisioning/transport behavior are out of scope.

The daemon-owned session artifact path remains the single authority for app-log output and process marker paths. The move must not widen paths outside the daemon-owned sessions directory or change app.log/app-log.pid naming.

Focused validation

Run:

• pnpm vitest run src/daemon/__tests__/app-log-files.test.ts src/daemon/__tests__/managed-session-artifact-path.test.ts
• pnpm vitest run src/daemon/__tests__/app-log.test.ts src/platform-runtime-app-log-output.test.ts src/platform-runtime-app-log-process.test.ts using the exact existing test paths if any differ
• the refactor(host-kit): move verified-file ownership into host-kit #2136 verified-file tests
• pnpm check:affected --run

Planted-red proof

No new structural rule is added. Keep the existing path-policy tests independent of implementation text and temporarily remove the realpath/basename confinement branch to observe the symlink-escape test fail before restoring it. The final run must show the existing typed-file boundary and app-log tests green.

Dependency order

This child cannot start until #2136 exposes verified descriptors through @agent-device/host-kit/file. The terminal child is blocked by this child and every other owner slice.

Shrink target

Delete both old utility implementations and both old tests. After discounting the physical move, the daemon destination must not add production lines; remove any now-redundant local path checks rather than adding wrappers. No app-log policy may remain in src/utils.