feat(runtime): supervise configured collectors through one bounded lifecycle

[forkwright]

Finding

The living vision promises one hardware-aware, runtime-configured Akroasis
binary, and current state explicitly says runtime selection plus a shared
collector boundary remain planned. Per-domain plans describe collectors, but
no live issue owns their application-wide lifecycle after the superseded
planning archive is removed.

Desired correction

Give the application one typed owner for configured collector discovery,
qualification, startup, health, restart, hot-plug, cancellation, and shutdown.
Per-domain crates retain their protocol logic and inject adapters into this
lifecycle rather than creating independent task supervisors.

• Separate read-only discovery from model/protocol qualification. A cable,
  VID:PID, or partial handshake alone cannot authorize writes.
• Derive enabled collectors from validated configuration and accepted runtime
  capabilities; unknown or unavailable hardware yields explicit state.
• Bound queues, retries, restart rate, and task cardinality. Shutdown and
  reconfiguration are deterministic and cancel-safe.
• Route typed observations into the production Phase 03 signal path with
  source identity, freshness, and observable drop/backpressure semantics.
• Expose the same live lifecycle state to the CLI/service rather than fixed
  placeholders or a second registry.
• Operator-requested start/stop/reconfigure/restart consumes the accepted security(runtime): authorize direct effects through one validated caller context #409
  caller context and lifecycle scope before transition. Automatic
  startup/restart/hot-plug carries explicit accepted configuration/system-policy
  authority; it never invents a human principal or bypasses the same bounds.
• Before each lifecycle mutation, commit a minimized durable intent with
  canonical collector reference plus configuration/policy/schema digest; append
  success, partial, recovery, or failure outcome. Raw device paths, captured
  payloads, and secrets never enter the receipt.

Done when

• The application can start, stop, reconfigure, and report multiple fake
  collectors through one lifecycle and deliver their signals to semaino.
• Deterministic tests cover simultaneous startup, failed qualification,
  disconnect/reconnect, hot-plug churn, stalled consumers, cancellation, and
  clean shutdown without hardware.
• Injected audit failure, partial transition, backpressure, and restart prove
  the declared ordering and recovery relation; a collector does not become
  accepted/running after an unrecorded transition.
• Missing, stale, revoked, wrong-persona, or insufficient caller authority
  performs zero operator-requested lifecycle transition; invalid automatic
  system/config authority likewise fails closed.
• A per-domain adapter cannot bypass the global bounds or claim a device is
  ready before its own qualification contract succeeds.

Boundary

This issue owns the global runtime/lifecycle mechanism and its state-transition
receipts. Domain-specific wire and device acceptance stays with its domain
issues, including mesh #83/#84, radio #79/#80, and SDR qualification. #409 owns
the shared validated-caller type/resolver; this issue owns its lifecycle
adoption and distinguishes human from accepted system/config authority.
Hardware qualification is separately operator-scheduled; this issue authorizes
no hardware use.