feat(dioptron): orchestrate invocations and ship the daemon binary

[forkwright]

What changed

The daemon now runs end to end. The orchestrator implements the wire server's Dispatcher on top of the custody store and epitrope, and the binary has real commands. Process-level acceptance tests drive the real binary only through the independent xenos client.

Producer seam

• Producer takes a cancel signal and a deadline.
• UnavailableProducer is the default: it always answers ProducerUnavailable{contacted: false}, so the binary never fetches anything.
• FixtureProducer is scripted per target, counts its calls, and runs only behind an explicit --producer fixture:<path>.
• There is no HTTP, DNS, SSRF or extraction code anywhere; the real Zetesis adapter stays behind Consume Zetesis acquisition instead of implementing a second static-fetch stack #66.

Capture lifecycle

• B1 begin authorizes, reserves and persists intent. Then:
  1. a re-check of the chain at dispatch;
  2. B2;
  3. the producer runs, with cancel and deadline, while its chain is re-checked every 100 ms;
  4. B3, which stores the envelope verbatim;
  5. B4 publish;
  6. B5 settlement, with the chain checked again.
• Early stops:
  • no effect yet → released (Revoked / Expired / Cancelled / DeadlineExceeded);
  • effect started → actual cost settled;
  • producer can't say → UnknownEffect;
  • revocation or expiry after the effect → published with revoked_after_effect.
• The orchestrator owns the settlement task, and it drains on shutdown.

Other paths

• Every capability goes through the same designated-grant authorization.
• Dry-run writes nothing.
• A replay re-authorizes before returning anything. If the grant has since been revoked or has expired, it returns the current Denied without the stored content.
• Refusals carry no invocation id, so foreign and missing resources produce identical bytes.
• Read is chunked to the negotiated frame size.
• Audit reads are scoped per D17.7, and each one records the designated grant and the scope applied.
• Ingest is refused as NotSupported until the D7 pipeline exists (Phase 03).
• An omitted limit reserves the remaining ceiling from the caller's own ledgers, capped by documented daemon limits.
• The Query predicate is a case-sensitive substring match of at most 1024 bytes.

Binary (std::env::args)

• Commands: serve, keygen, init, tenant add.
• serve fails closed on a locked store before it binds anything, recovers, prints ready <socket>, and shuts down on SIGTERM.
• Test hooks, compiled only when their cargo feature is enabled:
  • failpoints: DIOPTRON_FAILPOINT=after_commit:B2 and similar abort the process at that point;
  • test-clock.

Contract and store updates (the contract stays at v1; nothing has shipped)

• New codes: DenyCode::NotSupported and ReleaseReason::Expired (answered as Denied{GrantExpired}).
• The idempotency binding now covers digest, grant, session and target, without the declared cost, so a retry with a new deadline replays instead of conflicting.
• Audit entries store the grant and scope.
• The contract doc gains the early-stop settlement table, the claim order, and the unset-limit and predicate rules.

Why

Phase 01 S2 acceptance: "An independent test client must exercise the wire, not just call the in-process implementation."

This PR wires every S2 piece into one runnable daemon and proves each acceptance clause against the real binary.

Stage and acceptance

Phase 01 S2, closing slice. Clause → test (process tests in crates/dioptron/tests/process/):

Clause	Test
Grant attenuation, expiry, revocation	grants::child_grant_is_refused_on_every_widened_axis_and_issued_when_narrower, grant_is_refused_outside_its_validity_window_as_the_clock_moves, revoking_a_parent_invalidates_descendants_and_stands_on_replay, expiry_of_a_running_call_before_effect_releases_it_as_expired
Forged peer identity	identity::every_forged_identity_gets_the_same_auth_failed_bytes
Cross-tenant read and metadata denial	isolation::foreign_and_missing_resources_answer_identical_bytes, audit_reads_stay_inside_the_granted_scope
Dry-run has no effects	dry_run::dry_runs_call_no_producer_and_leave_the_store_byte_identical
Replay of the same invocation	replay::replayed_capture_returns_the_first_outcome_across_restart_without_a_second_call, replay_after_revocation_is_denied_and_returns_no_stored_content
Crash and reopen at each durability boundary	crash::crash_{before,after}_b{1..5}_* (10 tests, real process abort)
Frame corruption, oversize, incompatible version, partial connection	wire::*
Revocation of queued and running calls	grants::revocation_of_a_dispatched_call_before_effect_releases_it, revocation_after_effect_publishes_the_marker_and_reads_need_a_live_grant
Session → capture → read → restart → read → unauthorized peer	flow::session_capture_read_restart_read_then_unauthorized_peer_is_refused

Proof (toolchain 1.97.1)

• Tests: 556 pass across the workspace. The process tests passed 5 consecutive runs; the default-features process tests passed 2 runs.
• Lint: clippy -D warnings is clean with all features, with default features, and with each feature alone.
• Supply chain and docs: cargo deny check, cargo tree -d (documented skips only), fmt and the doc checks are clean.
• Independent adversarial review:
  • it implemented the integrator rulings: Ingest as NotSupported, audit grant and scope, distinct expiry, replay re-authorization, unset-limit derivation, and the predicate bound;
  • a B1 step failure left its reservation held; it is now released;
  • a capture without an idempotency key answered as a conflict; it now answers ProtocolError;
  • CLI argument parsing accepted malformed input; that is fixed.