Add standalone single-engine snapshot companion

[nessie993]

Summary

• compose one authenticated incarnation watch, ZMQ owner, long-lived digest source, UDS snapshot runtime, and metrics server into an off-by-default executable
• harden and authenticate session/digest/attestation files before any bind, connect, or socket publication; fence immediately on invalid refresh
• use one absolute shutdown deadline with task abort and content-free closed-label telemetry
• keep the companion in a dedicated Dockerfile so ordinary LB images link only mini-dynamo
• document the remaining host attestation-provisioner boundary before node06 shadow

Validation

• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked: 298 library + 31 integration/E2E
• release build of both binaries; off-mode executable smoke
• Go parity and 79 Python tests + 5-case agent corpus
• source branch container smoke and dual-domain Compose validator
• warm no-op Docker builds: LB 2.16s, companion 3.38s

No production Compose, image push, or node06 mutation.

[nessie993]

Rebased onto main after the Drone-only CI merge and closed the independent rollout blockers found in review:

• serve-mode preflight now rejects DS4_SNAPSHOT_MAX_CLIENTS != 2 before protected-file load, metrics bind, ZMQ ownership, or UDS publication
• root-run CI fixtures use explicit non-root companion/client identities without weakening production UID validation
• the binary now implements passive healthcheck <socket> with exact safe-parent/socket ownership, type, mode 0660, and link-count checks; unknown/fixture commands fail closed
• removed misleading EXPOSE 9091; production metrics need a separate permission-isolated UDS/Caddy design

Clean validation: 299 lib + 35 integration tests = 334/334, Clippy strict, fmt, Go parity, 101 Python tests, both Docker images and hardened companion healthcheck container. Drone is now the only CI check and is running on this head.