#24606 acpmux: dispatch attributed briefs across harnesses

Agent-to-agent dispatch is now a first-class acpmux operation. A coordinator can run acpmux dispatch BRIEF --target HOST|auto; brief bytes cross the authenticated peer connection, the destination starts the requested harness, and acpmux briefs ls, briefs steer, and briefs report preserve one attributed brief identity. The ledger is atomic and survives daemon restart. Placement excludes air-blue, cosmic-gray, and big-red; cmux16 is capture/build only. Load and per-host capacity are warn-only: no launch is refused for load.

Leo said: "This also seems a little bit too ad hoc than what I'd like. Maybe we need to keep improving ACPM UX then, or CMUX next, just exposing more and more and, like, depicting the stuff better."

Changelog

Added: harness-agnostic acpmux dispatch, brief lifecycle commands, peer forwarding, and authenticated sender metadata.

Validation

• pr-overlap before edits: no overlap.
• Changed-file rustfmt and git diff --check pass.
• Fleet test: cmux-ci run --class isolated --script scripts/ci/cmux-tui-rust-check.sh --ref 9cd406e3a7d3c9af583919537870538337ddf788 --arg test --arg dispatch submitted as cf7f00c6f2576d7a61e85ef1, cancelled before execution because the commit was not published; exact-head retry submitted as 4d85e68ac68845ff499eee1c after publishing the branch.
• Full fleet result is pending; no native build ran on huge-blue.

agent-identity footer

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Makes agent-to-agent dispatch first-class in acpmux: acpmux dispatch BRIEF --host HOST|local|auto sends a brief over the authenticated peer connection, starts the chosen harness on the destination, and keeps one attributed brief identity across briefs ls, steer, and report. The brief ledger is atomic, survives daemon restart, and mirrors peer-forwarded brief rows back to the local ledger.

• Dispatch is harness-agnostic; --target aliases --host. Sender attribution comes from the authenticated connection, never caller-supplied fields; empty or over-1 MB briefs are rejected.
• Placement excludes air-blue, cosmic-gray, and big-red; cmux16 is capture/build only; auto targets the least-loaded allowed connected host.
• steer and report forward over the peer running the brief; idempotency keys make duplicate dispatch, steer, and report calls replay-safe, and brief claims happen only after host validation. Report status accepts only running, reported, or merged.
• Load pressure is warn-only and suggests a next suggestedHost; peer dispatch with an approve-all policy requires a person-approved preset.
• _acpmux/dispatch, steer, briefs, and report are excluded from session-scoped peer forwarding, and forwarded dispatch preserves the authenticated web-guard marker.