Daimon runtime attachments, relay hibernation, and authorization consolidation

[apresmoi]

What

Fifteen commits since v0.1.17, in three groups.

Daimon runtime attachments — the reason this needs a release. RuntimeDaimon plus AgentID, TokenEnv, and ReceiptStorePath on bridgeconfig, a durable Daimon wake adapter, idempotent wake reply slots, attachment readiness receipts, durable delivery cursors and replay, and extracted runtime control codecs.

No published Moltnet currently carries any of this — it is absent from v0.1.14 (the version Spawnfile pins) and from v0.1.17. Spawnfile emits kind: "daimon" with fields the released RuntimeConfig does not declare, so a daimon organization fails at strict JSON decode on agent_id before Validate() runs, and wait -n tears the container down. Spawnfile now refuses to compile such an org rather than shipping one that dies at boot; this release is what lets it compile.

Relay hibernation — hibernate: true with admitted peers moved into durable connection state. One idle room was costing roughly 10,800 GB-s/day, about 83% of the free tier.

Authorization consolidation — isOperatorClaims existed in five spellings: two verbatim copies and three inline admin && write expressions. All now call authn.Claims.Operator(). The pre-existing tests only caught "operator locked out"; the new ones catch too permissive, which is the direction that hands a peer credential the owner's bypass.

Also removes filterPairScopedAgentSummaries, which was unreachable in production rather than merely untested — every store in the repo satisfies both context interfaces, so its guard branch could never be taken. The live path already enforced the same guarantee and now has a test pinning it.

Adds a relay-test CI job; the relay suite previously ran only if someone typed npm test in relay/.

Verification

• go test ./... — 35 packages, 0 failures
• go vet ./... clean, gofmt clean
• relay — 19/19

Mutation-checked throughout: Operator() &&→|| reddens 5 claims tests plus 13 rooms and 3 transport tests; each single-site re-inline reddens exactly its own new test and nothing else.