[R1] Deliver one foreground command for a bounded single-worker lifecycle

[jjangg96]

Goal

Provide a foreground MVP command that connects the reviewed broker and paired worker lifecycle for one organization, one private repository and one worker, with durable fail-stop state and safe owned cleanup.

Dependencies

#60, #66, #67

Scope

Extract a vertical R1 slice of #4/#5/#6/#7/#9/#10/#13/#14, with primary parent #13. Reuse the reviewed paired Linux-container execution path on this Mac as the first backend; this does not add native macOS jobs, Lima or a second backend. No context switch or live daemon mutation. Freeze the minimal input/status/lifecycle contract before implementation. Manual foreground start/stop only; unattended daemon/install and general scheduling remain R2.

Acceptance

• One documented user-facing entry point, explicit configuration and safe status output; no claim that the existing empty product entry point already implements it.
• Bound org/repository/installation and one owned worker, shared capacity hard-limit one, management/worker credential separation.
• Connect original controller journal, canonical worker/admission state, bounded broker handoff and exact ownership checks; no duplicate mint/create/launch after unknown effects.
• Foreground interruption stops new admission and preserves busy/unknown work for explicit inspect/drain/recovery; no implicit workflow replay.
• Negative tests for authority mutation, partial state, timeout, cancellation and non-owned cleanup; full offline executable proof and reviewed source/artifact identity.
• State unsupported service/reboot/native/multi-org modes explicitly; no blanket removal of original parent dependencies.
• Focused independently reviewed PR and exact-head CI/Codex verdict. Live end-to-end acceptance is tracked separately.

Execution and safety

Release R1. Maintainer-approved delivery reorganization #66; preserve the full original parent issue and historical records. Main implementation Grok 4.6 xhigh; independent Luna max review. TDD meaningful failing behavior before minimal implementation; exact commands/results, gaps and rollback. Exact-head clean external Codex review (inline/comments/stale) and CI required before merge. Existing #1 native Goal stays unchanged; no additional native goal during this coordinated run. No live operation is authorized by this issue: reviewed immutable commits and explicit concrete maintainer authorization required. Preserve manually installed runners, existing App/Keychain/launchd/Docker context; no busy cancellation, broad cleanup, workflow replay or credential/raw-log disclosure.