M7: complete headless MCP runtime cutover

[provencher]

Summary

Completes Milestone 7 / PR 8 of 8 for the headless MCP domain runtime stack.

• keeps the shipping CLI default on --backend app; auto and headless remain explicit opt-ins
• makes auto probe and choose the app or direct backend before MCP initialize, with immutable session selection
• keeps interactive and exec modes app-only, including when auto or headless is requested
• uses canonical profile/root-backed domain runtime services for direct workspace, tree, search, read, and selection behavior
• replaces the former closure dependency bag with typed physical capability adapter families
• removes legacy mixed routing/catalog/lifecycle compatibility paths and enforces schema/MainActor guardrails
• carries advertised window_id and _windowID one-shot presentation identity into an explicit authoritative app context at admission, without active-tab fallback
• pins app-spawned Agent children to --backend app

Rollout

This PR intentionally does not change the default from app. Direct headless remains available through explicit --backend headless; app-first probing is available only through explicit --backend auto. A future default cutover requires separate live/release evidence.

Validation

• exact M7 worktree packaged and relaunched through conductor; final debug app running
• omitted backend and explicit app preserved app CLI behavior
• explicit auto selected app before initialize in 8.38 ms and remained app-bound after the app was stopped
• public window_id bind and _windowID one-shot representative reads succeeded
• app Agent Mode start/wait sentinel completed with M7_APP_CHILD_PIN_OK
• with the app stopped, explicit auto selected headless and initialized in 34.93 ms
• direct stdio exposed the canonical 20-tool catalog, read the isolated canonical root, applied and reread a profile-scoped authorized mutation, and exited cleanly on EOF
• explicit headless matched representative root/read semantics
• auto/headless interactive and exec requests failed fast with exit 2 rather than falling into direct mode
• focused MCPDomainHostTests, product package/build, provider suite, lint, guardrails, and the 3,770-entry test contract ledger passed
• mandatory commit and push preflights passed

Known blocker

make dev-codex-schema-check remains blocked by the local installed Codex CLI version (0.144.1) being below the repository-required 0.145.0. This is a known toolchain availability blocker, not an observed M7 schema divergence; no default cutover is claimed here.

Stack

Base: feature/headless-runtime-m6-direct-backend (d3677c3e82d171affe08d35587e0bd9bd4561b0f)