feat(daemon): the supervisor proven, a preflight that names every fault at once

§7's supervisor arrived written and unproven. It is now proven, and the two
mutants that matter are recorded rather than asserted: deleting
`self.token.cancel()` reddens three tests (and takes 30s, which IS three tasks
× JOIN_TIMEOUT); replacing the join with a detach reddens three more, caught by
the `Arc::strong_count` assertion that states invariant C2 as an observation.

Dimension 7.5's cancellation test owns a real listening socket and is cancelled
while genuinely parked in `accept()`. It carries a CONTROL —
`test_supervised_accept_completes_when_a_client_connects` — because a negative
without one is vacuous: with a client connected the same `select!` takes the
other branch, so the cancelled case is a race genuinely won rather than one
against a branch that could never fire.

The abandoned-task test costs no wall clock. `#[tokio::test(start_paused)]`
plus a task parked on `pending()` leaves the runtime idle, so tokio advances to
the ten-second deadline itself. A ten-second test is one that gets deleted.

One arm removed rather than covered: a `JoinError` here can only be a panic.
The other source is an abort, and this supervisor owns every handle and never
calls one — a join that times out DROPS the handle, which detaches. The
cancelled arm was a branch no test could reach, and §1's `Mac256::compute`
precedent says remove it, not exempt it.

Preflight is deliberately NOT the Zig shape. `serve_boot.zig` exits at each
check in turn, so an operator holding three unset knobs learns about them one
restart at a time; Dimension 8.1 asks for all of them in one output. So it
RETURNS its faults, and `main` is the only place in the crate that names an
exit code — which is also the only reason any of it is testable, since
`process::exit` in a library needs a child process to observe.

Missing and invalid stay apart because they are different operator actions:
supply a value, versus correct the one you wrote.

Presentation, per Indy: a start banner and a fatal renderer.

- The banner is one greppable line off a terminal and a two-row mark on one.
  Box glyphs in journald are something to grep past.
- The fatal is the Ruby `GlobalExceptions` mixin retrofitted, bomb and
  `We flunked!` kept. Four of its bugs are not: colour is conditional and
  honours NO_COLOR (the original always emitted escapes); it writes to stderr
  rather than DEBUG (where the account of a death could be filtered out); it
  walks the `source()` chain, which Ruby had no equivalent for; and an error
  with no matching frames still prints, where `unless trace.empty?` gave the
  loudest failures the quietest output.
- `render_with_trace` exists because `Backtrace::capture()` is `Disabled`
  without `RUST_BACKTRACE`, which would have left the frame filter as code that
  only ever runs in production.

Measured, `cargo llvm-cov -p agentsfleetd --all-features`:

    lines 100.00% · functions 100.00% · regions 99.23%

The three uncovered regions are the `?` paths in one `Display` impl, which
cannot be taken because writing to a `String` cannot fail. Two coverage traps
from the M176 handoff bit and are fixed at the source: `JOIN_TIMEOUT.as_millis()`
inside a `tracing!` field is hoisted to a `let` (the `log` bridge compiles field
expressions twice and llvm-cov scores the dead copy), and a `write!` split
across five lines gets a region on its closing delimiter — the workspace's
one-line `Display` idiom does not.

    cargo test -p agentsfleetd --all-features  →  23 passed; 0 failed
    make lint-rustd                            →  ✓ [rustd] Lint passed

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>