feat: replace Guest control with ComponentSession

[vicondoa]

Summary

This completes the v3 Guest control-plane clean break. Feature-specific Guest
RPCs, legacy daemons, and the unreleased host cutover path are replaced by one
authenticated ComponentSession and Resource API architecture.

The final branch:

• uses signed controller placement and one fenced assignment per resource;
• runs shared d2bd host / d2bd guest and d2b-broker host / guest
  artifacts as separate mode-bound authority instances;
• deploys Provider controllers and workers as target-local Processes;
• routes exec, shell, activation, configuration, health, semantic Bindings,
  display, clipboard, notification, audio, security-key, and telemetry through
  resources, typed services, and named streams;
• keeps ordinary Guests isolated from Zone stores, public sockets, Host
  authority, realm credentials, and sibling Guests;
• gives gateway parent-Guest and child-Zone roles separate daemon and broker
  instances, sockets, state, identities, and audit roots.

Clean break

The branch removes d2b-guestd, the legacy exec runner,
guest_control.proto, generated bindings, runtime bridges, old Guest Nix
services, token material, stale closures, and compatibility fallbacks.

It also removes the entire unreleased cutover feature: the d2b-cutover
package, CLI and public-wire operations, daemon and broker handlers, runner,
Nix packaging, schemas, policies, fixtures, VM and live-host tests, and
current operator documentation. No v1 cutover option, deprecated command,
feature flag, or no-op compatibility path remains.

Old peers fail closed. There is no SSH, raw tunnel, direct-spawn, Host-broker
fallback, legacy Guest RPC path, or cutover escape hatch.

Design decisions

• Nix and the Zone resource store remain authoritative.
• Controllers create Process or Endpoint children; they do not spawn feature
  processes directly.
• Bindings remain explicit user intent and are never synthesized by Services.
• The editable Guest configuration stays at
  /var/lib/d2b-guest/guest-config.nix, owned by the workload user with
  d2bd group read access.
• Host integration builds the fixed eight host tools with local Bazel and
  injects those outputs into NixOS VM checks, including shared Guest daemon and
  broker binaries.

Session-settled decisions carried from planning: shared daemon and broker
executables, target-scoped controller instances, ComponentSession as the only
Guest control plane, explicit Bindings, and resource-backed child execution
were user-directed; the separate config Provider was user-approved.

Known limitation

Non-QEMU USBIP attach fails closed with runtime-capability-unsupported.
The legacy Guest importer is gone, and the signed usbip-guest-proxy
Process/effect adapter is not yet available. Host-only export is never reported
as success, and failed Guest detach does not release the host claim.

Validation

• make check
• make test-host-integration - all 13 retained NixOS VM checks passed
• Host integration used the staged Bazel host-tool bundle instead of
  rebuilding d2bd or d2b-broker through Nix
• Attic dependency-closure upload completed without caching VM test results
• labs/** and nix/gas-city-contributor/** remain unchanged