feat(runtime): prove a truthful application-wide offline connection state

[forkwright]

Finding

Akroasis promises that every external connection can be verifiably disabled,
but the application has no single typed inventory or truthful offline-state
owner. Domain-specific stops cover only their own effects: the Lethe
protected-route kill switch, Praxis automation stop, server exposure policy,
collectors, and future provider connections cannot prove that an unregistered
or stuck path is closed.

Desired correction

Give the application runtime one external-connection capability inventory and
disable/offline orchestrator while retaining domain ownership of connection
mechanics.

• Every domain registers a typed connection capability plus bounded
  open/refuse, close/cancel, and status hooks.
• Disabled/offline posture refuses new opens and closes or cancels every active
  registered path within an explicit bound.
• Missing, failed, timed-out, or unregistered hooks produce explicit
  incomplete/noncompliant state; the application must not claim offline.
• Startup, restart, reconfiguration, and hot-plug preserve the requested
  posture without silently reopening a path.
• Operator-requested posture changes consume the accepted security(runtime): authorize direct effects through one validated caller context #409 caller context
  and offline-control scope before transition. Automatic startup/restart uses
  explicit accepted configuration/system-policy authority, never an invented
  human principal.
• Lethe protected-route, Praxis automation, Peira assessment, and other domain
  stops retain their narrower semantics and register with rather than replace
  the application-wide owner.
• Every requested posture transition commits a minimized durable intent and
  success, incomplete, recovery, or failure outcome with canonical connection
  references plus policy/schema epoch. Raw addresses, paths, payloads, and
  credentials are excluded.

Done when

• Deterministic fake adapters representing inbound listeners, outbound
  clients, and collectors prove disabled startup, live transition to offline,
  restart, reconfiguration, timeout, stuck-close, and late-registration cases.
• A no-egress fixture proves no fake path opens or transmits after the disabled
  posture is requested, every accepted active path closes/cancels, and the
  reported state names any incomplete hook instead of claiming success.
• Injected audit failure, partial transition, backpressure, and restart prove
  that an unrecorded or torn transition cannot be reported as complete and has
  an explicit bounded recovery state.
• Missing, stale, revoked, wrong-persona, or insufficient caller authority
  performs zero operator-requested posture transition; invalid automatic
  system/config authority likewise fails closed.
• The CLI/service consume the same typed capability receipt rather than a
  second boolean or registry.
• No real network mutation, hardware, firewall change, or production endpoint
  is required or authorized by this issue.

Boundary

#400 remains the global collector lifecycle and integrates its adapters into
this inventory; #401 remains the transport-neutral field runtime; #409 owns
the shared validated-caller type/resolver. Domain crates own connection
protocol behavior. This issue owns only application-wide inventory,
orchestration, caller/system-authority adoption for posture changes, truthful
offline status, and their minimized transition receipts.