feat(wake): W4 — per-host delta-gated detector daemon (fail-loud source semantics, enqueues to W2 store)

A1 of the wake canon (EPIC #892). A per-host, single-instance, long-lived
detector SERVICE (not a timer) that generalizes the proven delta-gated poller
and enqueues observed deltas into the merged W2 durable store.

- §1.1 placement: per-host single-instance (non-blocking flock; a 2nd instance
  refuses), serves local panes only, no cross-host waking. A long-lived service,
  not a timer. Generalizes the poll->hash->deliver-only-on-delta exemplar and
  adds (a) repo-section/anchor-scoped hashing so human-decision FILE edits are
  caught, not just API-visible state.
- §1.2 observe->store: on a delta, assign the next observed_seq and enqueue to
  store.sh with {class, locators, emit_ts} via its public API (store not
  reimplemented).
- §2.4 cursor semantics: detector-local observed_seq is a monotonic int assigned
  AT OBSERVATION and authoritative; source SHAs are descriptors. A per-watch
  last-observed hash is compared each poll so a revert (A->B->A) is caught.
- §4/G2a fail-loud source semantics: a source error / 401 / 403 / privacy-404 /
  partial / ambiguous-empty response fails loud, does NOT advance observed_seq,
  and is NEVER treated as "no change".
- Gate B (#869): the watch-list schema_version is validated against the manifest
  [schema_min, schema_max]; out of range => rejected (fail loud), never coerced.

RED-first harness (test-wake-detector.sh), wired into test:framework-shell:
no-change->no enqueue; change->exactly one enqueue with a fresh observed_seq;
revert A->B->A caught; single-instance flock; schema out-of-range fail-loud;
source error/ambiguous-empty fail-loud with observed_seq not advanced;
anchor-scoped hashing (outside-anchor edit = no-op, inside-anchor edit = delta).
Fake/stub sources only (no live network); shellcheck clean; operator-agnostic.

Part of #892

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

packages/mosaic/framework/tools/wake/manifest.txt

@@ -13,8 +13,9 @@
 # Component identity + semantic version.
 #   0.1.0  W2 — store+drain lib + ack-wrapper.
 #   0.2.0  W3 — cumulative-state digest renderer + non-circular HMAC signer.
+#   0.3.0  W4 — per-host single-instance delta-gated detector daemon.
 component=wake
-version=0.2.0
+version=0.3.0
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version
@@ -31,5 +32,8 @@ schema_max=1
 #                    two-tier trust, injection/secret scrub).           (W3)
 #   sign.sh     A5 — non-circular HMAC signer (independent wake_id,
 #                    load_credentials by-name; fills the hmac placeholder). (W3)
-# Out of scope (later waves): detector (W4), FN-oracle/reconciler (W5),
-# beacon (W6), installer (W7).
+#   detector.sh A1 — per-host single-instance delta-gated detector daemon
+#                    (flock, anchor-scoped hashing, detector-local observed_seq,
+#                    fail-loud source semantics; enqueues deltas to store.sh). (W4)
+# Out of scope (later waves): FN-oracle/reconciler (W5), beacon (W6),
+# installer (W7).