feat(bin): add managed host-root mode for native Windows

[YrFnS]

Intent

Complete and validate FirstMate PR #1238 so native Windows Pi started from the Second Brain host inside Herdr actually loads the managed host activator, injects the configured FirstMate environment, and can dispatch a disposable isolated worker. Fix Windows physical-path comparison and generated ESM import URL handling without weakening fail-closed physical-root, ownership, or explicit host-root mismatch checks. Preserve current upstream behavior, narrow legacy compatibility, Claude Stop recovery, Herdr as the Windows backend, Orca's experimental status, and cross-platform Linux/macOS behavior. Resolve all verified review findings, including recoverable rollback metadata with missing endpoint ids and Herdr cleanup lock reentrancy, with minimal shared-boundary fixes and focused behavioral coverage. Push the validated branch to the existing open PR, but do not merge it.

What Changed

• Add an opt-in host-root mode and managed Pi activator that layers FirstMate policy, skills, hooks, and environment onto an external host repository while keeping workers in isolated task worktrees.
• Extend backend, spawn, supervision, rollback, and teardown flows with native-Windows Herdr path handling and host-bound endpoint ownership safeguards.
• Document host-root operation and add focused setup, activation, routing, rollback, cleanup, and real Herdr end-to-end coverage.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ **Rebase** - passed

✅ **Review** - completed

🔧 **Test** - 1 issue found → auto-fixed ✅

✅ **Document** - passed

⚠️ **Lint** - 1 warning

✅ **Push** - passed

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1238 at eb42af2e.}

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1238 at 39e72446.}

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1238 at baa5ef04.}

[YrFnS]

Rebased this PR onto current main and updated the host-root topology: the external host remains the supervisor authority, while ordinary ship/scout workers launch in their isolated target worktrees and load target-repository instructions natively. FirstMate briefs, completion signaling, recovery metadata, teardown safety, and SecondMate isolation remain intact.

Validation at head 929cbb4c passed no-mistakes review, focused host-root/Orca/real-Herdr checks, the complete behavior suite, documentation checks, and pinned ShellCheck lint. One unrelated Calm/Pi 12-second notification wait was intermittent; it passed in the preceding full run and on immediate isolated retry.

The new upstream Actions runs are currently action_required with no jobs, so they need maintainer approval before CI can execute:

• CI: https://github.com/kunchenguid/firstmate/actions/runs/30697737213
• Require no-mistakes: https://github.com/kunchenguid/firstmate/actions/runs/30697737190