feat(multiverse): private immutable lifecycle transport

[loganj]

Draft scope

Owner-private encrypted Start/Restart/status requests and correlated outcomes; author-only reads/fanout; duplicate request redelivery. Adds FTS exclusion with populated migration coverage.

Depends on feat/multiverse-remote-stop-fab2f134; part of six dependent drafts atop #7347 (dfce9ba3). Frozen inventory/Stop heads are unchanged. Head: 72c2903c5b370aaec6480eb4ca0e656955f82522.

Evidence

The composed candidate 5ec1955862d11bd9c01b7e3318f09b7076101423 passed full just ci, 6,266 frontend tests, production artifact build, 3,178 native unit + 10 integration tests, and native/workspace Clippy. This is composed-candidate evidence, not a claim that each earlier unmounted slice independently exercises the whole feature. Splitting changed no product bytes.

Earlier direct package attempts exposed environment limitations: relay media tests lacked a configured PostgreSQL pool; a direct buzz-db source-attribution guard failed in the unchanged production source; the first separate PostgreSQL lane failed local setup before tests. Full just ci subsequently passed its configured lanes. Separate populated PostgreSQL/private relay evidence is being collected, not assumed green.

Explicitly unperformed / not delivered

• No two-Desktop/two-Mac lifecycle walkthrough, successful real relocation, or real process-tree cleanup acceptance. These are documented limits, not a drafting gate.
• No deployed host-owned broker credential provisioner. Production Start/Restart cannot spawn a new keyless runtime until that integration is supplied; the current provider returns provisioning_unavailable. Injected success tests are not deployed provisioning evidence.
• No keys, files, configuration, or workspaces transferred. No auth weakening, arbitrary signer, or keyful launch fallback.
• Draft only: no merge, deployment, release artifact, or technical approval claimed.

Product authority

Approved Multiverse semantics: newer sender seconds/lower event-ID ties; scoped Stop; current-host-only Restart; failed/interrupted Move has no automatic continuation. This follows the settled Multiverse design rather than the older provider/key-transfer vision in VISION_REMOTE_AGENTS.md.

Origin channel: f45d3304-dcf0-44e8-a46d-bcd63b235fbc
Origin thread: 16211fefcee85904f49802ce5e1709bf24b4895401a944f0585e70233c4e4d39
Owner drafting direction: 4ed62424758aea3898b084f9e24d7fd9791d7dc53738d01ed1c0dbbae1adb8e7.

[loganj]

Additional exact-head validation

At composed tip 5ec1955862d11bd9c01b7e3318f09b7076101423, the separate PostgreSQL lane now passes 260/260 (all buzz-db ignored PostgreSQL tests plus the Desktop transport tests). This includes populated migration 0049 and both lifecycle kinds through authenticated HTTP/WS privacy and exact-request duplicate redelivery.

The previous 259/260 result was a fixture URL spelling issue: an unchanged test strips postgres:// literally; the initial local admin URL used postgresql://. Using the test-supported URL spelling resolved it with no product change.

Full composed just ci, 6,266 frontend tests, 3,178 native unit + 10 integration tests and Clippy remain passed. Real two-Desktop/process-cleanup acceptance and deployed broker provisioning remain explicitly unperformed/unimplemented; this evidence does not establish real relocation.