Add remote HTTP daemon mode with lease admission controls
Summary
Add remote daemon HTTP JSON-RPC transport/server mode with tenant/session isolation controls, structured machine-readable errors, configurable state directory support, and optional auth hooks.
Add tenant run lease lifecycle (lease.allocate, lease.heartbeat, lease.release) plus admission enforcement for tenant-isolated command execution (--run-id + --lease-id).
Refactor HTTP transport handling into a dedicated module and add focused lease unit tests and HTTP integration smoke coverage updates.
Touched files: 16.
Scope expansion beyond initial command family: yes (daemon core/router + HTTP transport + new lease handler/module + CLI flag schema + integration/docs) to deliver end-to-end remote tenancy admission behavior.
Validation
pnpm typecheck
pnpm test:unit
pnpm test:smoke
Smoke note: loopback-restricted environments skip HTTP integration smoke tests by design (with optional enforcement via AGENT_DEVICE_REQUIRE_LOOPBACK_TESTS=1).