Fix detached launcher runtime hydration

[bigboateng]

Summary

• seed the exact Git-common bootstrap runtime in detached mode
• keep supervision-aware shared activation under the external controller root
• fail before bootstrap publication when detached shared state is unsafe

Boundary conformance

• Boundary: verified installer/hydrator to Git-common bootstrap, then bootstrap helper to detached shared/local activation
• Control law: tracked launchers execute only the exact pinned, checksum-verified bootstrap and dispatch only through a verified local runtime
• Failure behavior: invalid or symlinked shared state fails closed without publishing bootstrap or local bytes

Validation

• go test ./...
• go build ./...
• go vet ./...
• python3 -m unittest discover -s .github/tests -p "test_*.py"
• release-note validate and committed-diff preflight

Release note: release-notes/2026-08-09-detached-launcher-bootstrap.md