feat(code): freeze Aether Code host protocol v1

[AetherAI3]

Summary

• freeze the private aether.code.host/1 supervision contract while preserving aether.exec/2 and aether.exec.control/2
• add strict validators for handshake, worker identity, controls, host actions, credential boundaries, and completion ordering
• publish canonical cross-repository fixtures with raw-byte hashes and bundle digest 924f6f3d26cd052020d226d0c07828416f75f8245677b028efd7815d346f03c0

Ownership and dependency

This repository is the canonical producer of the host protocol fixtures. A follow-up AETHER-CLOUD PR will consume the merged commit and exact fixture bundle digest. No runtime is enabled by this PR.

Verification

• npm run build
• npm run lint
• focused contract suite: 10/10
• existing headless protocol regression suites: 30/30
• npm run docs:check

Compatibility and rollback

The existing public execution and control protocols are unchanged. This is additive, default-off contract work; rollback is a clean revert before any Cloud runtime flag is enabled.