feat(daemon): add nonpersistent worker mode

[rynfar]

Closes #20

Cross-links:

• Prime tracker: Track Pylon fork parity and upstream overlap #1
• Pylon provider umbrella: Prime provider parity: tasks, automation, and upstream watch pylon#114
• Comet integration umbrella: Prime Agent integration: coordinate Comet, Pylon, and fork contracts rynfar/comet#1
• Blocked Comet consumer: feat(harness): run one bounded correlated Prime text turn rynfar/comet#7
• Imported upstream CI fix: fix(ai): build from the committed model catalog instead of refetching it PrimeIntellect-ai/prime-agent#2038

Summary

Add the capability-negotiated nonpersistent_daemon_worker_v1 mode for fresh client-owned daemon workers.

The mode requires an exact create contract (workerRecovery:"disabled", noSession:true, no tools, no extensions, and no autonomous gates), returns a generation- and owner-transport-bound create proof, accepts only a narrow correlated text command surface, and retires rather than recovers or adopts the worker after transport loss.

The final process fixture explicitly selects an isolated custom model against a reserved-then-closed loopback endpoint. This removes host Prime CLI auth and live API dependence from the nonpersistent correlated lifecycle regression.

This PR also imports upstream commit 0894de1ded368f175b41baeb16ba3a58ec66f828 with -x provenance. That upstream fix makes packages/ai build the committed reviewed model catalog instead of refetching mutable live catalogs. GitHub CI required it after live catalog drift removed identifiers still referenced by the base tests. The explicit generate-models refresh command and Pylon build:offline remain.

Safety properties

• keeps prompts, correlation identifiers, create receipts, configuration, and launch environment out of journals and durable worker/session artifacts;
• forbids replay for disabled creates and proof-bound commands, including shared recovery-enabled clients;
• binds worker lifetime and proof to the exact creating socket object and physical transport generation;
• snapshots public commands before handshake waits with the same JSON semantics as the existing wire serializer;
• disables session persistence, tools, extensions, autonomous continuation, recovery, relaunch, adoption, update restart, root mutation, and transcript-transforming commands;
• uses positive command allowlists at supervisor and worker boundaries;
• bounds create retry retention, prompt ingress, in-memory snapshots, and byte-aware JSONL frames;
• authenticates before private identity registration and recovery-mode validation;
• quarantines inconsistent descriptor/marker provenance and performs PID/start-ID-safe retirement.

Ordinary workers keep their existing recovery, replay, command-journal, summary, and attach behavior.

Public contract

• protocol 7 / schema 31
• schema ID: protocol-7-schema-31-8a52a7010c1f
• frozen SDK feature: nonpersistent_daemon_worker_v1
• supervisor offers the matching capability only when this mode is supported
• optional raw create IDs remain one-shot when absent; public DaemonClient.request() owns envelope IDs

Exact validation

Frozen source:

• base: 68603ed89bb597cd715fd6a77bc1c39d7e110298
• head: fc28e5604d104a0fafcda5f1766ec846caf2f363
• tree: ad8dcdbda8bba834ff8b55d62314627e6856cc69
• base-to-head patch SHA-256: eac94201d77bc7e6326748c8fd3228e817a6a4c52e861f704e2af8ec27771d09

Results:

• five independent exact-head P0/P1 reviews: security, lifecycle/concurrency, API/protocol, tests, and documentation — all approved;
• npm run build — passed without changing models.generated.ts (fd3c13075f0a24e4f1fddae294c6a9000f31aeae5dbf7f6f8ead2a3d84419cbc before and after);
• npm run check — passed;
• affected daemon suites — 457/457 passed on the byte-identical daemon parent;
• npm run test:pylon-release — 10/10 passed;
• scrubbed npm run test:ci — 341 files and 4,820 tests passed, 57 skipped;
• scrubbed npm run test:process — 23 passed, 9 skipped;
• clean Docker Linux regression: the parent reproduced the missing-model failure; this head passed with an explicit isolated custom model and a closed loopback endpoint;
• git diff --check — passed.

Two clean detached worktrees independently built, verified, installed, and smoke-tested the release with Node 22.23.2 / npm 11.10.1. All outputs were byte-identical:

output	SHA-256
pylon-prime-agent-0.8.1.tgz	8dec2de0a527e7b9e7a0d0dd0bbce8ddd708686ab9c051ba01c3e23a1a369d01
pylon-prime-agent-ai-0.8.1.tgz	b2b6f9edf964349ea731743964055e7aeb54eb18ce1aae7f40202ebc01f26660
pylon-prime-agent-core-0.8.1.tgz	77f4a8a4e6a1b5a7d20135bece341c6261528fc5247de7deae8d4913f0e22e8a
pylon-prime-agent-tui-0.8.1.tgz	fb0522478b059820dbdee0350d00eb7e4999b50d86ce70cbc368898792c1687b
pylon-prime-agent-release-v1.json	a2241d02bf851d35dcb5bc724f309f611816e12102fd4efb27073a2dc9be5168

Local validation receipt SHA-256: c3298680951edba9c72e79c4b975ed62f89f5849008a33c23d3b8adf7803ab84.

Merge order

Prime #20 first. Then Comet #7 must consume and revalidate this exact contract/artifact before its correlated text-turn PR can merge. No Pylon provider contract is changed in this PR.