Fix multi-session daemon lifecycle and identity diagnostics

[laulpogan]

What changed

• Replace historical-key daemon eligibility with restart-safe live-owner leases and retirement.
• Cap all-session workers, preserve service tuning, and expose queued and stale state.
• Expand doctor diagnostics for identity collisions, binary skew, stale MCP processes, relay health, and supervisor fan-out.
• Preflight local relay operations and make local-sister pairing converge bilaterally.
• Isolate host-state tests and cover 655 stale homes across restart.

Root cause

Historical private keys and daemon-written activity kept every session home permanently eligible. MCP startup bypassed supervisor bounds, service installation reset tuning, and local pairing returned before both peers consumed the signed handshake.

Validation

• test-env/run.sh
• 654 Rust library tests: 653 passed, 1 ignored
• within-system stress: 11 passed
• shell integration: 11 passed
• 655 stale-home restart: zero workers, bounded RSS
• git diff --check
• GitNexus compare review against main

Live launchd state and dotfiles remained untouched during implementation.