feat: expose typed broker and Adobe host runtime identity

[loonghao]

Summary

The current broker health/capability and Photoshop facade contracts can prove that a Photoshop UXP session exists, but they cannot prove that readiness belongs to the exact selected broker, Photoshop process, profile, and installed bridge.

Required contract

Expose a typed, authenticated runtime identity attestation that includes:

• broker PID, process-start identity, executable path, runtime version, and instance ID;
• Photoshop PID, process-start identity, executable path, host version, and profile ID;
• UXP target, bridge kind/version, connection epoch, bridge instance ID, installed plugin root, and loaded module origin;
• stable structured failures for missing, stale, ambiguous, or mismatched identity.

The adapter must be able to cross-check these values against independent OS process observations and its install receipt. Identity fields must be bounded, secret-free, and unavailable rather than guessed when the host cannot provide them.

Acceptance

• stale PID reuse, wrong Photoshop executable/profile, foreign target, mismatched connection epoch, and plugin/module shadowing fail closed;
• broker and host attestation are covered by adversarial protocol tests;
• existing tokens never appear in health, capability, error, or receipt output;
• no arbitrary JavaScript/Python execution and no UI automation fallback is introduced.

This blocks exact-instance directly_usable: true for the Photoshop Install SOP lifecycle. Current adobepy 0.6.2 can still provide compile/package/session evidence, but not this runtime identity proof.

Refs dcc-mcp/dcc-mcp-photoshop#104
Refs dcc-mcp/dcc-mcp-core#2252