refactor(supervisor): add backend-neutral boundary primitives - #2942

Summary

Add permanent backend-neutral boundary primitives to the process and network supervisor leaves while preserving the legacy orchestration path. This is PR 2 of 2 in the draft stack. PR #2943 is an unstacked follow-on that prototypes runtime activation.

Stack: codex/1737-rfc12-contract → this PR. Unstacked follow-on: #2943.

Review-only prototype: The original code author is @jganoff, and the original implementation source is jganoff/OpenShell:jganoff/rfc-0012-impl. This reconstructed stack is for reviewing and prototyping RFC 0012; we do not intend to merge these PRs. The stack is rebased onto current main and integrated with the current canonical process and networking architecture.

Related Issue

Part of #1737. The final PR in this stack closes the issue.

Changes

• Add boundary-owned process, exec, PTY, signal, wait, and cleanup primitives around the canonical main-process session.
• Allow network mediation to consume an optional backend-provided source without removing transparent TCP or legacy listeners.
• Resolve binary identity before mediation and fail closed on unresolved ownership.
• Add strict network-namespace egress-ceiling installation and verification APIs.
• Retain legacy networking with an explicit None mediation source.

Testing

• Supervisor process, network, and sandbox crates compile together
• Contract tests pass
• Privileged/socket tests require an environment that permits namespace and socket creation

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (covered by PRs 1 and 3)