feat: run Daimon Grok 1.0.34 workers lean and isolated

[apresmoi]

Summary

Consumes the Daimon Grok broker contract from noopolis/daimon#24–#28 (vendored manifest sha256:401da56d…0829).

• Worker config.toml bytes are Daimon's pinned renderer output for the agent's declared model × effort; verified at compile and in provisioning.
• Brokered Grok agents must declare execution.model.primary {provider: xai, name ∈ grok-4.6|grok-4.5|grok-build, auth.method: grok} plus reasoning_effort; never inherited. No workspace skill roots for Grok.
• Worker home per Daimon layout (root-owned 0444 config/trust/managed/requirements/sandbox, 1771 .grok and sessions), service.json v2 (per-slot ledger, limits, model), canonical registration paths.
• Non-empty deny list covering broker/realm/bootstrap, peer homes/workspaces/resource backings, Moltnet/memory/agents state, all persistent mounts, /run secret roots; exhaustive coverage test over every provisioned path; compile-time refusal of entries at/above base-profile grants and of nested masks.
• Temp/spill isolation: private worker TMPDIR, /tmp//var/tmp root:2000 1774, setgid tool-output 2000:<worker> 2750, private broker/relay TMPDIR.
• Runtime image and containers: Grok 1.0.34 pinned from the manifest; pinned seccomp (default + namespace syscalls) with apparmor=unconfined for Grok orgs instead of fully unconfined; host user-namespace preflight.
• spawnfile usage: dedupe by turn, conflict reporting, limit_reason/model/estimated usage marked ~.

Draft until the Daimon stack merges and the live check runs.

Verification

• npm test: Vitest 3556 pass; 9 failures are the pre-existing Docker/Linux-/proc tests that fail identically on main locally. Typecheck and test:scripts pass.
• Mutation checks for each enforced property (red → green).
• Cross-checked against Daimon source: service.json parser accepts output, profile bytes equal Daimon's renderer, projection matches registrations, temp attestation accepts provisioned modes.
• Three rounds of cross-vendor (Grok) review; no open P0–P2.
• NOT RUN (needs Docker space + dedicated login): SPAWNFILE_GROK_LIVE_CHECK=1 … npm run test:live:grok-lean-worker (one real model call).

🤖 Generated with Claude Code