Part of #77.
Daemon native wake (WakeMonitor / app-server injector):
- claim_or_skip before injection;
- token re-check before outbound;
- wire the existing audit deny-gate to deny non-owner/non-addressee.
AC: native path injects only for the lease owner; non-owner denied with a log line.
Part of #77.
Daemon native wake (WakeMonitor / app-server injector):
AC: native path injects only for the lease owner; non-owner denied with a log line.