#22553 Deliver private daemon role lifetime channels

Cloud enrollment can finish after the session daemon starts. The root supervisor now delivers private role lifetime channels to its authenticated daemon after enrollment, fences stopped-role callbacks, and waits for a stop acknowledgement. Replacement daemons authenticate again. Protocol v1 carries no keys or service grants; Native receiver composition remains follow-up.

Validation: hosted Linux passes five privileged process cases and one ordinary control, including actual daemon replacement. Fmt/Clippy and Rust 1.91 pass; macOS is pending. The baseline reproduced the missing channel. Nine scoped static checks pass; the existing localization audit still fails.

Changelog

none