feat(runtime-host): add local standalone service foundation

[M4n5ter]

English

Summary

Add the local-only foundation for running Runtime Host as a standalone service without changing the existing candidate/election behavior.

• Separate transport-neutral protocol messages from Local IPC newline framing.
• Make the kernel consume an abstract message transport and listener set, while preserving the current Local IPC adapter.
• Bind each admitted connection to an immutable authority record instead of embedding local-user assumptions in operation handling.
• Add explicit ephemeral and service lifecycle modes.
• Add maka runtime-host serve [--root <path>], backed by the same execution composition as the existing Runtime Host candidate.

The new service keeps listening while idle, owns the selected storage root for its lifetime, and releases registration, endpoint, connections, composition, and root ownership during an explicit shutdown. This is Phase 1 of the standalone service work; remote WebSocket transport, authentication, policy enforcement, and operations remain tracked separately.

Refs #2522

Verification

• npm --workspace @maka/runtime-host test — 780 passed
• npm --workspace maka-agent test — 350 passed
• Runtime Host TypeScript build and CLI typecheck passed
• Biome and git diff --check passed
• Process-level smoke test verified startup, client connection, idle survival, reconnection to the same Host Epoch, graceful SIGINT shutdown, and immediate root-owner reacquisition

Remaining work

• Phase 2: remote WebSocket listener and explicit authentication
• Phase 3: authorization policy and remote-safe defaults
• Phase 4: operations, discovery, and production hardening

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

概要

为 Runtime Host 增加可独立运行的本地服务基础，同时保持现有 candidate/election 行为不变。

• 将与传输无关的协议消息和 Local IPC 换行分帧拆开。
• 让 kernel 依赖抽象消息传输和 listener set，并保留当前 Local IPC adapter。
• 为每条已接纳连接绑定不可变的 authority 记录，不再在 operation 处理路径中隐含本地用户假设。
• 增加显式的 ephemeral 与 service 生命周期模式。
• 增加 maka runtime-host serve [--root <path>]，复用现有 Runtime Host candidate 的 execution composition。

新服务在空闲时仍会持续监听，在生命周期内独占指定 storage root，并在显式关闭时释放 registration、endpoint、连接、composition 和 root ownership。这是独立服务工作的 Phase 1；远程 WebSocket transport、认证、策略执行和运维能力仍由后续阶段追踪。

关联 #2522

验证

• npm --workspace @maka/runtime-host test — 780 项通过
• npm --workspace maka-agent test — 350 项通过
• Runtime Host TypeScript build 与 CLI typecheck 通过
• Biome 与 git diff --check 通过
• 进程级冒烟测试验证了启动、客户端连接、空闲存活、重连到同一 Host Epoch、SIGINT 优雅关闭，以及立即重新取得 root ownership

后续工作

• Phase 2：远程 WebSocket listener 与显式认证
• Phase 3：授权策略与远程安全默认值
• Phase 4：运维、发现与生产加固

检查清单

• 测试覆盖本次变更，并能在缺少实现时失败
• lint、format、typecheck 与受影响测试套件均在本地通过

本 PR 是否改变行为？

• 是——已在概要中说明
• 否