fix(state): establish authoritative runtime root

[Yeachan-Heo]

Summary

Issue #3139 exposed split-brain state-root selection: nested invocations could report no active mode while native hooks still enforced a parent session's state. This change establishes one persisted, authenticated, canonical-realpath state-root authority per run and makes mutation, status, cancellation, launch, hook, HUD/doctor, team/tmux, restart/resume, worktree, and migration surfaces resolve through it.

Changes

• Add workspace-bound authority anchors, immutable generations, revisioned bindings, leases/fences, journaled transactions, authenticated child transport, and bounded migration/recovery.
• Make state writes, clears, status, cancellation, native hooks, HUD/doctor, team workers, tmux launches, hotswap, MCP, Ralph, and session lifecycle fail closed when authority proof is absent, stale, foreign, replaced, symlinked, or ambiguous.
• Keep raw transport bearers process-local; publish persistent launch effects only after journaled verification and use nonce-scoped, value-free tmux transport.
• Add compiler-assisted production callsite inventory, exact-head three-OS authority CI, state model documentation, and broad security/regression coverage.

Validation

• npm run build
• npm test — bounded exact-head run was stopped after exceeding the requested time bound; it reported no failures through 9,935 retained output lines, including the authority/native-hook surfaces reached before cancellation.
• Conflict/rebase causal matrix: 8 affected compiled files, 1,036 tests passed, 0 failed.
• Approved authority matrix: 628 tests passed before the sole inventory-drift assertion; the stale ranges/missing row were repaired, then the complete 19-test inventory file passed with zero production violations.
• npm run check:no-unused
• npm run lint — 738 files checked, no fixes.
• git diff --check
• npm run smoke:packed-install
• PyYAML parse of .github/workflows/authority-state-root.yml
• omx doctor — setup/config behavior is not changed by this authority fix.

Checklist

• PR is focused on authoritative runtime state and its directly affected integrations.
• docs/STATE_MODEL.md documents the new authority model.
• Backward compatibility is bounded to authenticated deterministic migration; caller-selected mutation roots intentionally fail closed.

Related

Addresses #3139.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]