feat(sdk): establish the canonical local protocol contract

[SarthakWade]

What this changes

Adds a deterministic Swift-owned SDK contract exposed by headless schema, with typed command parameters, result metadata, command scope, transport timeout policy, local lifecycle errors, trust markings, compatibility policy, support policy, and checked-in golden schema and conformance fixtures.

Adds supervised host ownership for SDK-launched processes. The canonical default is platform-neutral headless start --supervised; macOS presentation is included only when callers explicitly request foreground or background behavior.

Closes #163

Security and lifecycle

• Uses only the existing private same-user Unix socket.
• Adds no TCP listener, debug port, arbitrary JavaScript, remote control, or direct credential values.
• Keeps page-derived data marked untrusted and sensitive diagnostics double-gated.
• Rejects unknown request fields and unsupported capabilities.
• Refuses existing shared hosts during supervised launch and grants ownership only after startup and socket PIDs match.
• Stops and reaps only the launcher and host owned by the SDK.
• Preserves the platform default when presentation is omitted, allowing Linux launch without a macOS-only option.

Verification

• pnpm test: 65/65 protocol tests, secure terminal tests, and MCP integration
• pnpm test:runtime
• pnpm test:npm
• Web lint and production build
• macOS build and protocol suite
• Linux Docker E2E
• macOS WKWebView E2E
• Linux amd64 and arm64 release artifacts
• macOS and multi-platform container release artifacts

Stack

This is the base of the SDK stack. #181 depends on this PR, and #182 depends on #181.

[yashranaway]

The Swift-owned schema, golden fixtures, and supervised start path match ADR 28 and the host hard rules.

headless schema stays a local CLI command. start --supervised refuses an already-running host, grants ownership only when the ping PID matches the child, and shuts the host down when the owner pipe closes. Transport is still the same-user Unix socket. Auth parameters are challenge/account only. Unknown request fields stay rejected.

Required CI is green, including Linux E2E and macOS E2E.