[T6-2 / §9.10] kill-switch.c — per-class/global termination + gossip revoke

[mdheller]

Deferred-runtime (Linux). Modes KILL_CLASS/KILL_BUNDLE/KILL_ALL/PAUSE_CLASS/RESUME_CLASS via /sys/fs/bpf/sourceos_killswitch_ctrl. §9.10: revoke propagates via gossip bus; MCP channels drop in seconds. LEDGER_PATH must NEVER be local-only — refuse to activate + emit LEDGER_PATH_REQUIRED otherwise (SEAM-011). Spec captured at ~/dev/spec-intake/2026-07-31/ (register: docs/spec-intake on sourceos-spec branch capture/spec-intake-register-2026-07-31). Part of the Agentic-Stack / Tranche program (epic SocioProphet/socioprophet#490).