Harden delegated agent runtime durability and isolation

[fkguo]

Summary

• add a durable tool-attempt journal with compare-and-claim dispatch, exact result replay, and fail-closed unknown outcomes
• make delegated tool policy and approval authority non-bypassable, with typed approval envelopes and canonical run-gate reconciliation
• isolate MCP subprocess environments, credentials, process groups, reconnect budgets, and timeout behavior
• harden delegated handles and execution identities, and separate root, direct-agent, and team-derived journal namespaces
• update public architecture, runtime, CLI, and testing documentation

Verification

• pnpm --filter @nullius/orchestrator test — 85 files passed; 1116 passed, 10 skipped
• pnpm -r build — all 13 in-scope workspace projects passed
• node scripts/check-shell-boundary-anti-drift.mjs
• pnpm --filter @nullius/hep-mcp exec vitest run tests/docs/docToolDrift.test.ts — 15 passed
• git diff --check
• built CLI help and external init --runtime-only / canonical status / project-local launcher smoke tests

Coverage boundary

Process containment was exercised on macOS/POSIX fixtures. This PR does not claim real Windows or external authenticated MCP-service coverage.