fix(daemon): preserve recorded ownership through stop and cleanup
Summary
Stop, takeover, drain, and cleanup use ownership and lifetime from one registration read. Central retirement refuses a live embedded or unrecognized owner without a signal. It retires a provably exited owner, so a crashed host cannot block managed startup. Legacy disk records without ownership remain detached.
The review repair removes premature client guards, maps retained owner reasons once, consolidates registration projections, removes an unused parameter, and corrects the embedded-stop fixture. Help and docs distinguish unreadable plain-stop metadata (daemon-record-unreadable) from the early --clean refusal (daemon-clean-not-detached).
This prerequisite for #3797 supports #3747 and #3757. It changes 36 files, with 2,212 gross lines. The public host API remains later work.
agent-device daemon stop --state-dir /tmp/agent-device
Validation
Head e574ba365abbce8766bbed17ff2bae48ae8dd0f4, merge base 8e9361a789. The managed-command regression fails at old b7df117 for dead embedded/unrecognized owners and passes at the repair, with no signal to the old owner.
pnpm check:affected --run --head e574ba36: 36 runnable checks passed. Receipt run-k8c1I5: exactCommit=true, checkoutChanged=false. GitHub-owned skips are not passes. This lifecycle change needs no device run.
Independent code and smaller-design review approved f5b44dfa. Independent sentence review approved the final prose at e574ba36; no findings remain. Required CI remains pending.