fix(runtime): consolidate profile ownership and remote-view recovery

[ecochran76]

The production runtime fixes, ownership diagnostics, remote-view handoff work, and policy improvements accumulated on one long-lived plan branch while the installed candidate was qualified separately. This PR consolidates that work onto main so the repository matches the running candidate and the durable incident evidence is no longer stranded off the default branch.

The installed candidate is source 052848aa with binary SHA256 71834ecdb3d3fe527a968303e31fb4c6c7f8cbf4ac4387d348b801581fd8bd93. Installation preserved five browser roots and 39 tab-custody records; post-install doctor, retained-handle attestation, durable-link reconnect, and trusted input passed. Plan0160 remains open for the outstanding A1–A4/AX acceptance work and deferred standalone CLI download compatibility.

Local validation for consolidated head ad120da2:

• Rust 1.98 format and Clippy with warnings denied passed.
• The complete repository Rust test gate passed before the final test-fixture-only commit. On the final local run, the changed identity test passed and two unrelated parallel timing tests failed; both passed immediate exact retries. The identity fixture now remains alive through a test-owned pipe instead of expiring after 30 seconds while CI hashes process evidence.
• Service API/MCP parity, generated client contracts and types, service collections, and route-confusion gates passed.
• Dashboard contract tests and production builds, plus the documentation build and remote-view handoff checks, passed.
• Workstation installation, host provisioning, VM harness, Guacamole assets and durability, route-specific user sync, and release-asset checks passed.
• The isolated live CDP tab-streaming smoke passed after its harness was corrected to preserve one self-declared task identity and supply the exact target on URL reads.
• The fixed-input producer and client harness now runs in the Rust job after the compiled suite. This removes a second full Rust compilation from the Service Client job; both resulting local lanes pass independently.
• The Cargo wrapper now applies host-capacity admission and user-systemd cgroups only to WSL. Native Linux CI retains bounded build jobs and acceleration without waiting forever for a 30 GiB WSL reserve; wrapper syntax and capacity tests pass.
• The Rust test gate now runs the CLI suite serially in one Cargo invocation and has a 30-minute step timeout. The previous partition loop recompiled the large CLI test binary for every filter on an uncached runner. The replacement complete local run passed in 12m33s with 3,117 CLI tests plus integration coverage and no repeated compilation. CI independently passed 3,060 active CLI tests, 57 ignored tests, and all integrations before exposing a missing pnpm setup in the subsequent smoke step; the Rust job now installs the same pinned pnpm version as the other Node-backed jobs.
• The subsequent no-launch smoke step builds one exact-head debug CLI, pins every command and MCP smoke to it, and is bounded to 10 minutes. The resulting end-to-end local chain passed the fixed-input harness, contracts, MCP inventory, profile and site-policy sources, remedies, and HTTP/MCP incident summaries. Its review also refreshed four current profile-acquisition/recovery MCP tools, obsolete CDP-free test names, and persistence checks that previously raced later status reconciliation and monitor scheduling.
• GitHub CI evaluates the pushed head independently.

Pre-existing local incident-note edits are outside this PR.