feat(wake): W4 — per-host delta-gated detector daemon (fail-loud source semantics, enqueues to W2 store)

A1 of the wake canon (EPIC #892). A per-host, single-instance, long-lived
detector SERVICE (not a timer) that generalizes the proven delta-gated poller
and enqueues observed deltas into the merged W2 durable store.

- §1.1 placement: per-host single-instance (non-blocking flock; a 2nd instance
  refuses), serves local panes only, no cross-host waking. A long-lived service,
  not a timer. Generalizes the poll->hash->deliver-only-on-delta exemplar and
  adds (a) repo-section/anchor-scoped hashing so human-decision FILE edits are
  caught, not just API-visible state.
- §1.2 observe->store: on a delta, assign the next observed_seq and enqueue to
  store.sh with {class, locators, emit_ts} via its public API (store not
  reimplemented).
- §2.4 cursor semantics: detector-local observed_seq is a monotonic int assigned
  AT OBSERVATION and authoritative; source SHAs are descriptors. A per-watch
  last-observed hash is compared each poll so a revert (A->B->A) is caught.
- §4/G2a fail-loud source semantics: a source error / 401 / 403 / privacy-404 /
  partial / ambiguous-empty response fails loud, does NOT advance observed_seq,
  and is NEVER treated as "no change".
- Gate B (#869): the watch-list schema_version is validated against the manifest
  [schema_min, schema_max]; out of range => rejected (fail loud), never coerced.

RED-first harness (test-wake-detector.sh), wired into test:framework-shell:
no-change->no enqueue; change->exactly one enqueue with a fresh observed_seq;
revert A->B->A caught; single-instance flock; schema out-of-range fail-loud;
source error/ambiguous-empty fail-loud with observed_seq not advanced;
anchor-scoped hashing (outside-anchor edit = no-op, inside-anchor edit = delta).
Fake/stub sources only (no live network); shellcheck clean; operator-agnostic.

Part of #892

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-digest-hmac.sh"
+    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-detector.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",