fix(mc-host): bind runtime execution to verified identity

[ahrav]

Summary

Native lifecycle execution now stays bound to verified generation and closure objects through spawn. The layer also closes restart snapshot drift, prevents dispatch after terminal closure, makes self-exec explicitly debug-test-only, and preserves cleanup ownership across failure paths.

Verification

• cargo clippy --workspace --all-targets -- -D warnings
• cargo test -p mc-host
• cargo test -p mc-module
• Focused lifecycle, closure, and Broca subprocess suites

Stack

1. fix(mc-host): authenticate daemon version transcripts #58 authentication transcript
2. fix(mc-host): bind runtime execution to verified identity #59 native runtime identity
3. fix(plugin): fence lifecycle compatibility by daemon #60 client compatibility
4. test(release): bind lifecycle evidence to attested runs #61 release evidence
5. fix(ci): restore portable lifecycle source checks #62 CI portability

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}