fix(isolation): authenticate managed output from persistent panes

[xiaoxueSunn]

Summary

Extract the managed-origin/read-isolation hardening from the original mixed PR into its own review boundary.

This PR:

• binds isolated botmux send authority to a daemon-attested session/turn/attempt and per-pane channel
• rotates capability files with no-follow/owner checks and revalidates authority immediately before provider effects
• fences outbound hooks, document comments, voice providers, sandbox relays, and V3 session relays against stale or cross-turn origin claims
• binds macOS persistent-pane reattach to the exact read/write capability set and policy digest
• keeps the security path separate from RIFF shutdown, PM2 fleet control, and classic Codex/RPC lifecycle changes

Stack

#596 has merged. This PR still depends on #597 and remains Draft until #597 merges.

src/core/process-start-identity.ts is a small shared helper also used by the PM2 split; the two branches carry identical content, so whichever prerequisite lands first leaves no semantic duplicate.

Validation

Latest master merge-state validation:

• security-focused changed tests: 10 files, 218 tests passed
• lifecycle / mutation gate / session replacement supplementary regression: 9 files, 460 tests passed
• worker wiring and real tmux replacement / reattach integration: 7 files, 104 tests passed after generating current merge-state build artifacts
• key gate + managed-origin + isolation + outbound-provider stress: 79 tests × 10 rounds = 790 passed
• TypeScript typecheck and TypeScript compilation
• git diff --check

Earlier full unit suite:

• 691 files passed, 3 skipped; 10,909 tests passed, 34 skipped; 0 failed
• production TypeScript/dashboard build
• public-domain audit and dist audit

No daemon, PM2, or RIFF runtime was restarted during validation. Persistent-pane behavior is covered by unit/source-contract tests; no live pane was recycled as part of this PR preparation.