feat(wake): W6 — off-host dead-man beacon + pluggable alarm-sink adapter

A8 of the wake canon (EPIC #892, W6): the independent liveness leg.

beacon.sh:
- MONOTONIC EMITTER (emit): strictly-increasing seq + emit_ts each cycle,
  shipped off-host via a pluggable sink adapter. The primitive the detector
  run-loop calls each poll (§1.3).
- DEAD-MAN / ABSENCE alarm (record + check): the off-host monitor's receiver
  and absence check. A missing/stale-past-SLO beacon FIRES the alarm and ROUTES
  it to a human/other-host, depending on nothing the dying host does (§1.3/§4-G1).
- PLUGGABLE alarm-sink / beacon-sink ADAPTER INTERFACE: the framework ships the
  emitter + interface; the operator owns the target endpoint, resolved BY NAME
  (load_credentials), never inlined (§1.4). FAIL-CLOSED: unconfigured OR
  unreachable target FAILS LOUD — no silent no-alarm host (§4-G2a).
- DEGRADED MODES (honest, not silent): a same-host sibling is REJECTED as
  non-independent (shares user-manager/host/sender/socket/session); an isolated
  host degrades to a FLAGGED different-supervision-root beacon; capture-pane is
  a liveness HINT only (§1.3).

detector.sh: a single minimal, opt-in W6 emit seam in the run-loop (inert unless
the operator wires WAKE_BEACON_SINK_CMD; a beacon emit failure never kills the
loop but is loud). No store/ack/digest/sign code touched.

test-wake-beacon.sh: RED-FIRST harness (10 invariant groups), wired into
test:framework-shell. manifest.txt bumped 0.4.0 -> 0.5.0 + inventory.

Part of #892

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

packages/mosaic/framework/tools/wake/detector.sh

@@ -402,6 +402,18 @@ cmd_run() {
     # A single failing source must not kill the long-lived service; poll-once
     # already failed loud on stderr for it. The loop keeps serving healthy ones.
     cmd_poll_once || true
+    # W6 SEAM (§1.3, off-host dead-man beacon): emit ONE monotonic liveness
+    # beacon per poll cycle. This is the ONLY W6 call site in the detector — a
+    # single, clean, opt-in seam. It is INERT unless the operator wires a beacon
+    # sink (WAKE_BEACON_SINK_CMD); wiring + install-validating that target is W7's
+    # job, not the detector's. Liveness is SPLIT from work-triggering, so a beacon
+    # emit failure NEVER kills the detector loop — but it is loud (not silent),
+    # and the off-host monitor's absence check (beacon.sh check) is the real
+    # safety net regardless of what this dying host does.
+    if [ -n "${WAKE_BEACON_SINK_CMD:-}" ]; then
+      "$SCRIPT_DIR/beacon.sh" emit >/dev/null || \
+        echo "detector.sh: WARN — off-host liveness beacon emit failed (see beacon.sh); the off-host absence check remains the authoritative dead-man." >&2
+    fi
     [ "$once" -eq 1 ] && break
     sleep "$interval"
   done