Share owned policy transport between native startup and bounded qualification

[EHotwagner]

Native seed startup and the finite no-game qualification caller now use one owned apphost launch, pre-exec handshake, framed parser and settlement path. The native context retains actual host/engine liveness and socket guards. The separate policy-only context uses a real worker-owned writable fixture descriptor, admits no native actors or sockets, and bounds qualification to one positive consume plus malformed-request and held-input controls, at most three sequential apphost launches.

Against protected main 794f5d1037fa1d85e2a3312c28a77a487ef59ccf, the complete delta is exactly seven helper-source paths (473 insertions, 59 deletions), including two new caller/control files. The delivery lineage includes the merged PR33 receive-order repair; its ancestry join preserved the selected transport tree before this narrow diagnostic repair. The malformed control requires natural exit 2 and the exact retained request-evaluation/exception diagnostic, with physical custody and byte checks. The new caller requires a private, single-link, one-use admission before creating its attempt root.

Validation and coverage:

• 89 portable Python controls passed with unmocked process effects prohibited. Controlled pipes, clocks and mocks supply source evidence; no policy, CLR, game or producer execution occurred.
• Source diff checks passed. Canonical GrowingLog, F# policy, ownership mechanics, reducers and Lua bodies remain byte-identical. The bounded added-line audit found no private evidence paths or credential-shaped literals.
• Both native PR33 gates passed at the inherited repair head. Native CI for this exact transport successor is pending; the existing gate will run the complete 89-control roster.

The genuine successor helper graph has 38 committed modules/fixtures. Retained actual policy restore/build and PE/PDB proof remain valid compilation evidence; fresh derived provenance placement and actual shared transport qualification are separate gates. Live infrastructure-generation inventory/cardinality must be provided by independently reviewed root supervision; checking a pinned census file alone does not supply it. No-game acceptance, native actor pumping, seed attribution, browser authority, requested-unit production and useful play remain unqualified. Post-last-snapshot disconnect coverage and SourceLink remote-content verification remain unknown. Generated profiles, admissions and private evidence are absent from this PR.