feat(cockpit): OBJ-A — assemble + orchestrate the full sovereign cockpit

[mdheller]

OBJ-A of the Next Assault. Now that Lanes 1–4 + Receipts are all on main, this fuses them into one assembled, governed, runnable surface — built and verified end-to-end overnight.

What lands:

• scripts/assemble-cockpit.sh — build-time stager. Runs build-cockpit.sh + build-agent-machine-sidecar.sh, lays out Contents/Resources/{cockpit, sidecars, scripts, policy} + a manifest. One command → the whole app staged.
• scripts/bearbrowser-cockpit-up — runtime orchestrator. Stands up the governed topology and points the cockpit at the gate, never the raw sidecar:

  cockpit → gate 127.0.0.1:8080 → agent-machine sidecar :8091   (+ receipts :8092)
  

  loopback only, foreground, tears down all three on exit.
• scripts/build-cockpit.sh — bug fix: its resolver self-check grepped the module's content for cockpitRuntime (0 hits — the file exports resolveBase), so it false-failed for every assembly once #468 landed. Now greps resolveBase.

Verified on the assembled staging tree:

• assemble → cockpit (43 files) + 68M sidecar (self-smoke 200) + staged scripts + manifest
• orchestrator up: gate(→sidecar)=200, receipts=200, cockpit-config rewritten → gate
• the moat holds: allowed read via gate → 200; POST /api/shell/exec via gate → 403 (blocked at decision time)

So the sovereign local control plane now stands up as one governed unit from a single command.

Follow-up: Homebrew/nix formula wiring (run assemble at package-time + install bearbrowser-cockpit-up as a CLI); per-service sovereign loopback map; the connect flow (cloud opt-in).