fix: private Grok worker temp, closed shared temp and worker-readable spills

[apresmoi]

Summary

• Grok 1.0.34 refuses to start when /tmp or /var/tmp (or any path at/above a base-profile grant) is in the sandbox deny list, so shared temp is closed by modes instead: the launcher exports a private TMPDIR=<worker home>/tmp, and the broker attests before every turn that /tmp and /var/tmp are root:<gid<2200> with no other search/write (provisioned root:2000 1774) and that every registered worker's private tmp is worker-only.
• Tool-output spills are written 0640 into a pinned (O_DIRECTORY|O_NOFOLLOW, dev/ino-checked) setgid directory, published by rename; a deployment-provisioned 2000:<worker gid> 2750 directory lets only that agent's worker read them.
• Launcher and service config refuse non-canonical registration paths and truncated worker environment paths.
• Documents the provisioning contract Spawnfile must implement.

Stacked on #27.

Verification

• Full npm test: 791 pass / 1 known intermittent failure outside this branch's files (passes isolated). Typecheck, build, verify:native, verify:contract-manifest pass.
• Mutation checks for each attested condition (red → green).
• Live zero-cost check (Grok 1.0.34, bubblewrap, pinned seccomp, two workers): temp files land in the private dir; evaluator files in /tmp//var/tmp unreadable and unwritable from tool calls; workers cannot read each other's temp or spills; Grok sessions and sandbox events unaffected.
• Two rounds of cross-vendor (Grok) review; remaining findings are defense-in-depth against the trusted runtime uid.

🤖 Generated with Claude Code