Add the strict private supervisor start reply

[arasovic]

Summary

• add the strict private accepted-or-rejected supervisor start reply
• validate accepted snapshots and require accepted state
• reject blank rejection messages, unknown fields, trailing JSON, wrong versions, null payloads, and both/neither payload keys
• distinguish missing keys from explicit JSON null while preserving exact encoded shapes

Verification

• go test -race ./internal/background -run SupervisorStartReply -count=20
• go test -race ./internal/background -count=2
• npm ci
• npm run verify
• go build ./...
• Windows test-package compilation
• two independent reviews; their shared null-presence finding was fixed and covered by four focused regressions

Mutation proof

Focused tests failed as expected when deliberately changing each invariant in disposable worktrees:

• allow both accepted and rejected keys
• bypass accepted Snapshot validation
• allow unknown top-level fields

No role dispatch, process launch, persistence, Manager, CLI, docs, or release behavior is included.

Closes #206