test(rfc64): bind M1 process identity across hosts

[branarakic]

Impact

This is a proof-only M1 harness change; it does not change DKG runtime behavior.

The three-node canary spans multiple machines. Linux PIDs are unique only inside one host, so comparing bare PIDs can reject a valid Publisher/Core pair that happens to reuse the same number. The adapter now reports a stable hostIdentity, and the harness defines an OS process as (hostIdentity, pid).

Because hostIdentity is a required wire field, the adapter protocol is explicitly bumped from runtime v1 to runtime v2. Old v1 adapter payloads fail closed instead of being misidentified as compatible.

The gate also rejects duplicated process-instance evidence and requires an Edge restart receipt to remain bound to the original host and durable directory. A single process-identity abstraction now governs both role distinctness and restart proof.

Before

sequenceDiagram
    participant P as Publisher host A
    participant C as Core host B
    participant H as M1 collector
    P->>H: ready(pid=101)
    C->>H: ready(pid=101)
    H-->>H: bare PID collision
    H-->>P: reject valid cross-host run

Loading

After

sequenceDiagram
    participant P as Publisher host A
    participant C as Core host B
    participant H as M1 collector
    P->>H: runtime-v2 ready(host=A, pid=101, instance=P1)
    C->>H: runtime-v2 ready(host=B, pid=101, instance=C1)
    H-->>H: compare (hostIdentity, pid)
    H-->>H: require unique processInstanceId
    H-->>P: accept distinct OS processes

Loading

Edge restart binding

sequenceDiagram
    participant E1 as Edge process 1
    participant H as M1 collector
    participant E2 as Edge process 2
    E1->>H: ready(host=A, pid=102, durable=D)
    E1->>H: exited(host=A, pid=102, instance=E1)
    E2->>H: ready(host=A, pid=103, durable=D, instance=E2)
    H-->>H: require same host and durable directory

Loading

Validation

• M1 focused tests — 75/75 pass
• Process/runtime boundary subset — 46/46 pass
• M1 TypeScript project — pass
• git diff --check — pass

[otReviewAgent]

🟡 Issue: The v2 wire protocol is still exposed through V1 runtime contracts

What's wrong
This PR changes the runtime wire protocol and payload shape, but keeps the old versioned type names. That makes the boundary harder to reason about and weakens the value of versioning exactly where adapters need a crisp contract.

Example
A caller implementing SelectiveCoverageRuntimeV1 now has to emit protocol v2 data with hostIdentity, so the type name no longer tells readers which runtime wire contract they are implementing.

Suggested direction
Separate evidence schema versioning from runtime adapter protocol versioning. The key is that the exported contract name should not say V1 while the required wire shape and protocol are v2.

For Agents
Rename the runtime-adapter-facing contracts consistently to V2, or make them versionless and let SELECTIVE_COVERAGE_RUNTIME_PROTOCOL own the wire version. Update runtime.ts, runtime-wire.ts, process-runtime.ts, and tests without changing behavior.