feat(harness): establish native Prime daemon foundation

[rynfar]

Summary

Establish the host-private native Prime Agent daemon foundation for #1.

• resolve an installed prime-agent executable to its canonical package and public root ESM export;
• validate matching VERSION, DAEMON_PROTOCOL_NAME, protocol v7+, DaemonClient, and DaemonAgentConnection.attach before daemon spawn;
• own a stable per-provider Unix socket, kernel owner lock, private session/runtime trees, compatible crash-leftover retirement, and fail-closed live-listener handling;
• bound bootstrap JSONL frames, reads, deadlines, heap, process groups, cancellation reapers, descendant cleanup, and typed privacy-safe failures;
• require the six stock-compatible baseline capability offers and record optional/unknown offers without treating them as active session negotiation;
• isolate the bootstrap bridge environment while preserving host-private daemon provider/custom configuration and removing recursion plus loader injection;
• add deterministic package/protocol/process/race/privacy fixtures and an opt-in installed-package smoke.

Closes #3.

Boundary

This PR is lifecycle bootstrap only. It creates no Prime session and adds no registry, RPC, synchronized document, model, or UI state. Session events must use a later asynchronous SDK host with response/event demultiplexing. Fork-only behavior remains disabled until both server and attach-side client capabilities negotiate it.

The later session slice is explicitly blocked on bounded public SDK ingress in pylon-code/prime-agent#13. Detached Prime session workers also need authoritative shutdown plus worker/descriptor reconciliation; the process groups here do not claim ownership of detached workers.

Compatibility and privacy

• Stock Prime Agent 0.8.1 passes without correlated_prompt_lifecycle_v1.
• Compatible future daemon protocols use the shared >= 7 rule.
• serverCapabilities are offers, not active negotiation.
• Package paths, socket/session paths, environment values, raw hello payloads, stderr, and diagnostics stay host-private.
• The public SDK is loaded only from validated exports["."]; canonical Node and canonical CLI targets bypass wrappers after discovery.

Validation

• cargo test --offline -p zeron-harness prime:: --lib — 15 passed
• cargo test --offline -p zeron-harness --test prime_daemon — 23 passed, 1 opt-in smoke ignored
• installed stock Prime Agent 0.8.1 opt-in discovery/load/connect/shutdown smoke — 1 passed
• cargo test --offline -p zeron-harness --lib -- --skip shell_env::unix::tests::falls_back_when_interactive_attempt_hangs — 105 passed
• cargo clippy --offline -p zeron-harness --all-targets -- -D warnings with only six explicit pre-existing lint exceptions — passed
• Prime-owned Rust files rustfmt --check — passed
• node --check crates/harness/src/prime/shim.mjs — passed
• git diff --check — passed

The skipped shell_env::unix::tests::falls_back_when_interactive_attempt_hangs failure reproduces unchanged on origin/main at b520992 (Option::unwrap() at shell_env.rs:330). Existing unrelated ACP unused-assignment warnings are unchanged.

Two independent final rereviews found no remaining merge blockers: one architecture/contract review and one adversarial process/privacy/path review.

Coordination

• Comet umbrella: Prime Agent integration: coordinate Comet, Pylon, and fork contracts #1
• Foundation issue: feat(harness): establish native Prime daemon foundation #3
• Pylon consumer umbrella: Prime provider parity: tasks, automation, and upstream watch pylon-code/pylon#114
• Prime fork tracker: Track Pylon fork parity and upstream overlap pylon-code/prime-agent#1
• Recovery/upstream work: Prime upstream sync candidate ready pylon-code/prime-agent#8, fix(coding-agent): keep snapshot catch-up failures isolated pylon-code/prime-agent#11
• Bounded SDK ingress: fix(coding-agent): bound public daemon client JSONL ingress pylon-code/prime-agent#13