feat(harness): own bounded native Prime sessions

[rynfar]

Summary

Closes #5.

Adds Comet's private, host-only native Prime session owner on top of the merged daemon foundation (#4) and reviewed Prime dependency 7238ac8cff25962ada9ffe4530b7d4d1cddc1b47.

• loads only the validated Prime public-root ESM API;
• requires frozen bounded_daemon_ingress_v1 proof before client construction;
• requires client_owned_sessions, chunked_snapshot, immutable_snapshot_transfer_v1, and authoritative_owned_session_cleanup_v1 before connect/create;
• creates and immediately attaches one fresh draft client-owned session using the public constructor plus instance attach();
• contains the SDK client in a 512 MiB V8 heap with 64 MiB daemon ingress, 16 KiB private control frames, 8 pending requests, and 32 normalized events;
• keeps native identifiers, session files, paths, payloads, credentials, diagnostics, and process details host-private;
• proves normal cleanup through owning complete_owned_session, or crash cleanup through fresh non-owner authoritative settled status;
• starts and readiness-proves a dedicated cleanup reaper before the session host, so cancellation and Drop only transfer ownership to an already-live bounded runtime;
• preserves poisoned shutdown ownership through the cleanup horizon, with early daemon consumption only after fixed request-admission evidence and successful exit of the exact supervisor;
• rejects non-UTF-8 control paths with fixed errors before private JSON construction or session-host spawn.

Scope

This is deliberately not a user-visible Prime provider. It adds no Harness, registry, RPC, synchronized document, settings, model selector, or UI. Prompts, streaming, steering, interruption, reconnect/resume, subagents, resources, advanced Prime features, and ACP fallback remain follow-up issues under #1.

Dependency provenance

• Prime merged dependency: 7238ac8cff25962ada9ffe4530b7d4d1cddc1b47
• Exact branded artifact SHA-256: d6065af7b7eb0bf8bb945d84618c4d06fecea66cf3d07ed75737310b447913cc
• Prime lifecycle/recovery/ingress PRs: fix(coding-agent): preserve correlated prompt ownership pylon-code/prime-agent#12, Device-local tabs + spaces as a searchable sidebar filter zeronsh/comet#14, Add native Windows caption controls zeronsh/comet#16
• Cross-consumer trackers: Track Pylon fork parity and upstream overlap pylon-code/prime-agent#1 and Prime provider parity: tasks, automation, and upstream watch pylon-code/pylon#114

Validation

Exact candidate: 3ba88e519d2b062dc705a4e17629ac135d286020 (tree bb5b90da8c098ac595a4b79afbda5ee4513d3d15)

• Prime library: 36 passed, serial
• deterministic session integration: 24 passed, 2 artifact-gated ignored, serial
• daemon foundation integration: 23 passed, 1 installed-package smoke ignored, serial
• exact reviewed artifact no-model create/attach/snapshot/authoritative-close smoke: passed
• installed stock 0.8.1 negative public-feature gate: passed before client construction
• reviewed artifact install: all 1,436 files byte-match the hashed release tar
• wider harness tests: all groups passed when excluding one unrelated baseline failure
• cargo check -p zeron-harness: passed; only 9 pre-existing ACP unused-value warnings
• focused cargo clippy for the library plus prime_session and prime_daemon: passed with only unrelated baseline lint classes allowed
• direct Rust 2024 rustfmt --check on every owned Rust file: passed
• node --check on both private shims: passed
• privacy/scope scan, git diff --check, clean worktree, and post-suite process/socket/descriptor leak scan: passed

The excluded test, shell_env::unix::tests::falls_back_when_interactive_attempt_hangs, fails identically at crates/harness/src/shell_env.rs:330:74 on this candidate and unchanged main@de66c08c3687208effe2e2fdb514d6d690f1cc0a. It is outside this diff.

Local validation receipt SHA-256: b31279d53828b9b0a91aea54bde73d2922e85bc50fca83295ea7e1d60a1ca445.
Artifact-install verification receipt SHA-256: 6e45ce08d50241ee9e8c1ba45e85f4b6a894c3532b6bae06f7c99c7380f3c12e.

Review gate

This PR must remain unmerged until:

• independent exact-head security/concurrency review reports no P0/P1;
• independent exact-head API/privacy/consumer review reports no P0/P1;
• independent exact-head adversarial-test review reports no P0/P1;
• trusted hosted CI is green for the exact head;
• all review conversations are resolved; and
• exact-head maintainer approval is recorded.

[rynfar]

Exact candidate opened as PR #6: #6

Commit-bound candidate:

• base de66c08c3687208effe2e2fdb514d6d690f1cc0a
• head 3ba88e519d2b062dc705a4e17629ac135d286020
• tree bb5b90da8c098ac595a4b79afbda5ee4513d3d15

The first review pass blocked the old head on poison-horizon, reaper-startup, UTF-8 serialization, and fake shutdown/coverage P1s. All were repaired. Fresh exact-head security/concurrency, API/privacy/consumer, and adversarial-test reviews now each report no P0/P1. Any head change invalidates those approvals.

Validation at this head: 36 Prime unit; 24 deterministic session (+2 env-gated ignored); 23 daemon (+1 env-gated ignored); exact reviewed-artifact and stock-negative gates pass; wider harness passes with the identical main/candidate shell_env baseline excluded; focused clippy, Rust 2024 rustfmt, Node syntax, privacy/scope, whitespace, and process/socket/descriptor leak scans pass.

Receipts:

• validation b31279d53828b9b0a91aea54bde73d2922e85bc50fca83295ea7e1d60a1ca445
• Prime artifact d6065af7b7eb0bf8bb945d84618c4d06fecea66cf3d07ed75737310b447913cc
• 1,436-file install verification 6e45ce08d50241ee9e8c1ba45e85f4b6a894c3532b6bae06f7c99c7380f3c12e

Trusted hosted release-build CI is running at https://github.com/rynfar/comet/actions/runs/33298602520, bound to exact head 3ba88e519d2b062dc705a4e17629ac135d286020. PR #6 must remain unmerged until required hosted jobs pass, conversations are clear, and exact-head approval is recorded.

[rynfar]

Trusted hosted release-build CI passed for exact reviewed head 3ba88e519d2b062dc705a4e17629ac135d286020: https://github.com/rynfar/comet/actions/runs/33298602520

• Linux x86_64: success
• Linux ARM64: success
• macOS: success
• publish: correctly skipped for a workflow-dispatch branch build

Maintainer merge approval is recorded for this exact head/tree only, based on the three commit-bound no-P0/P1 reviews, exact validation/artifact receipts, zero review threads, and this successful hosted run. Any head change invalidates approval.