Add gated native MLX worker and public coordinator path

[ProfSynapse]

Native Apple SFT now has a gated adapter path through the existing TrainingAPI/RunsAPI coordinator. The implementation joins public SFT input compilation, native runtime material, isolated child imports, retained-source tokenization, explicit model/LoRA/AdamW composition, bounded owned execution, authenticated command/terminal records and native artifact verification. Candidate capability remains closed pending independent hardware qualification.

The final saved adapter is reloaded and evaluated after the last optimizer update. The worker checks the optimizer's actual update count and independently parses saved safetensors to prove finite changed parameters. Darwin supervision uses kqueue rather than assuming os.waitid, which the qualification Mac's CPython does not expose.

Public submission is synchronous and bounded, preserving thread-affine host record stores. The host owns source evidence, preparation, keys, grants and durable state. The five existing artifact roles carry native MLX adapter/tokenizer archives and bound workload/lineage/metrics. Public logs/cancel/reconcile remain unavailable.

Validation: 228 CPU tests passed in one process (170.08 seconds), including the existing reference-host regression suite. Native facade tests cover start/outcome/verify/reverify/streaming, retained-store reconstruction, uncertain-submit non-replay, command-catalog collisions, terminal-record tampering and changed artifacts. These facade tests substitute the ML child. Separate local process tests cover real deadline/output/cancel/owner-loss behavior on Linux. On head de22015, Ruff 0.16.10 and 117 targeted native, Docker source and closure/lock tests pass. The Docker tests include their provider fixtures. Skill trees are synced and git diff --check passes.

RuntimeSpec adds native_environment while preserving legacy OCI canonical bytes. All seven SFT/GRPO/HF/packaged/Modal training and inference closure checks report CURRENT. The shared contracts.py change and its dependent manifest hashes are reflected throughout; inventories, member order and non-hash runtime pins are preserved.

This is not real-Mac/Syntunia completion. Remaining work: independent security/runtime review, selected-wheel/install provenance and real capture, reusable consumer preparation/qualification assembly over existing host ports, bounded Mac training/lifecycle qualification and authenticated Syntunia readback. No accepting hardware authority or operational native launch CLI is shipped. No model download, ML import or training occurred on the Mac in this task.

The checked-in review-required proposal pins the model/tokenizer revision and permits at most two fresh synthetic attempts, six optimizer updates and five minutes per attempt after root review. It is not execution authority. The desktop plan documents the exact remaining integration and acceptance boundaries.

Base: release/api-v1-completion at 0d515ae. No main merge or changes to the original API/Windows branches.