feat(rate-of-closure): add secure production web companion

[d-sorgcodexagent]

Outcome

Adds the source production same-origin companion requested by #4379 on top of exact parent PR #4388. Production launch is Python-only; Node/Vite remains an explicit development launcher.

Security and lifecycle contract

• serves only the manifest-qualified exact-revision bundle with an in-memory local_companion descriptor
• binds separate gateway and authority listeners on random IPv4 127.0.0.1 ports
• keeps bearer token and child port out of browser payloads and process argv
• admits only fixed capability/prepare/submit/status/cancel/result routes with exact Host, Origin, fetch metadata, body, media, and size policies
• validates every authority response against route-specific status and duplicate-safe domain contracts before canonical publication
• applies no-store/security headers to all methods and sanitizes protocol failures
• moves synchronous authority I/O off the ASGI event loop
• closes partial startup resources, reaps children, releases durable locks, and replaces only already-dead authorities before explicit requests without replay

Verification

• 1,313 Rate-of-Closure Python tests passed; 2 expected platform skips
• 101 focused companion/authority/status tests passed on Python 3.11 and 3.13
• 138 React files / 922 tests passed; 6 Node release tests passed with 1 expected Windows symlink skip
• Ruff/format, focused MyPy, high-severity Bandit, manifest, policy, module-budget, YAML/TOML, and diff gates passed
• exact head 822e90c914baeb73338d037df89c5281811b9f7f rebuilt and audited 71 immutable assets
• exact wheel installed without dependencies for asset verification, then installed with the advertised optional extra in a fresh environment
• installed console entry point, exact descriptor, gateway capability, normal shutdown, and child reaping passed from an unrelated Unicode working directory

Stack/release

Base remains codex/4378-static-inspection-runtime. Human review is approved by the owner; protected checks, parent dependency order, and ordinary non-admin merge behavior remain mandatory. This PR intentionally remains draft while its parent stack is open.

Closes #4379