Serve Sessions from the agent host

[SaladDay]

The agent host gets a production entry point, and dispatch stops treating one connection as one Session and one Environment, so a shared agent host can serve many Sessions once PR5c routes them to it.

Daemon

• oac-daemon agent-host --identity-file <path> --core-url <url> (Linux only; other platforms return the typed unsupported error). It reads the identity {"runtime_id", "credential"}, takes Harnesses from the image's /opt/oac/harnesses.json, mounts cgroup v2 at /run/oac/cgroup, opens agenthost and runs dispatch with its Environments and registry over the shared connect loop (serveConnections). It exits when Core stays unreachable for 2 minutes.
• The test rigs start the agent host the way production does.

Core–Runtime protocol (docs/runtime-protocol.md)

• Supersede. A bind of the bound assignment at a higher epoch fences and cleans up the earlier epoch's work as a release does, keeping the home, then binds and replies bound. Unfinished cleanup replies cleanup_unconfirmed and a retry repeats it. A Session's Environment never changes, so a superseding bind naming another Environment fails with assignment_conflict before anything is fenced. Lower epochs stay assignment_stale; the same epoch with other fields stays assignment_conflict.
• Per-Session transfers. Each Session has at most one transfer of each kind. A held or uncertain transfer blocks only its own Session's execution_start, transfers and its Environment's quiesce. Staged bodies across a connection are bounded by the sum of the write and preparation bounds (100 MiB).
• Per-Environment quiesce. environment_quiesce and environment_resume apply to the named Environment; other Environments keep running.

proto.Version is unchanged; the final merge bumps it once.

Checks

• go test -race ./internal/dispatch/, -race -count=50 on the new concurrent tests, focused agenthost/..., cli, proto; the gated agent-host suite in a throwaway container; darwin and windows daemon builds.
• make check-names check-docs check-ci.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}