Substrate-first runtime hardening and real host-process enforcement

[francescomaiomascio]

Scope

This PR lands the substrate-first hardening work done on arch/bring-up-consolidation:

• canonical local runtime/operator surfaces (yai-substrated, yai-daemond, yai-cased, yai)
• run-root coherence for local execution
• process watch + automatic enforcement loop
• host-mediated carrier applying real host-kernel actions for allow/deny/quarantine on real process targets
• normalization of facts/refs and process-centric graph linkage

Key guarantees

• no squash expected at merge time (preserve atomic commits)
• dual-mode high plane semantics preserved; substrate/full split remains at carrier boundary

Verification

Manual and automated local checks were run for:

• nested scope (user.ops) bind of real host process
• quarantine/allow/deny enforcement outcomes
• runtime/state/graph inspect consistency
• daemon-connected runtime mode