test(rustd): §7 — a runner's whole loop against the daemon that ships

Dimensions 7.1 and 7.2. The only suite in this workspace where a request crosses
a real socket into a real `agentsfleetd-rs` process graph, on real Postgres and
real Redis: enrol, read self, beat, lease the seeded event, capture memory under
the lease's fence, report it settled, then read the rows.

7.1 catches what neither existing tier can. `afd_fleet`'s suites call
`Leases::select`/`issue`/`report` directly, so they prove the SQL; `afd_api`'s
suites drive the real router over a store with no datastore behind it, so they
prove the guard order. Neither notices a verb served on a path no runner sends
to, a route the daemon boots without mounting, a guard resolving one identity
where the store scopes by another, or a lease payload the plane assembles that
cannot round-trip through the wire types a runner parses.

7.2 is the differ M175 §6 deleted, replaced by the weaker claim §7 says it is:
not "these rows equal the Zig's", which nothing can check any more, but "these
rows carry every column the ported statement was written to fill". The column
set is derived from `information_schema`, so a column a MIGRATION adds is caught
too. It records two facts a reader expects the opposite of: `runner_leases` no
longer carries `request_json` (the reclaim path joins `core.fleet_events`
instead), and `memory_entries` has no `workspace_id` at all — memory is
fleet-scoped and authorised by the lease on the way in.

Writing it found six preconditions no existing fixture models, because nothing
here had crossed the pull path before. Each came from the daemon's own refusal
line: a fresh runner reads DEGRADED until it beats a capability report; a
`config_json` of `{}` will not parse; `"steer"` is not in the closed `EventType`
set; and the money pass needs an active platform provider default AND a sealed
provider key in that default's workspace. They are documented in `e2e_seed.rs`
in the order the daemon consults them.

Each scenario creates, migrates and drops its own database and points `boot` at
it. That is not tidiness: sharing the lane database made the assignment pass see
ten candidate fleets from earlier runs and `ORDER BY created_at ASC` correctly
hand back the oldest, so a fleet seeded correctly failed with `UZ-INTERNAL-003`
and no amount of re-reading its own seed could explain it. Three consecutive
parallel runs pass.

`AFD_TEST_LOG=1` now switches the daemon suites' tracing from a sink to stderr.
Every diagnosis above came from one run with it on rather than from guesswork,
which is the whole reason it is worth a permanent switch.

Split across seven files by concern (RULE FLL): the loop, the shapes, the
scenario lifecycle, the Postgres preconditions, the request helpers, the row
readers, and the database's own create-and-drop.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>