feat(lease-broker): C3 broker supervisor artifacts + health predicate (#869)

#828 shipped fail-closed enforcement hooks (mutator-gate.py,
receipt-observer-client.py) with nothing supervising daemon.py or
guaranteeing its socket exists before a gated runtime starts. This adds
the activation-side supervisor mechanism:

- a systemd --user unit (mosaic-lease-broker.service) mirroring the
  existing tmux-fleet unit convention, with RuntimeDirectoryMode=0700
  so it satisfies daemon.py's secure_parent() fail-closed check
- a wrapper script (start-lease-broker.sh) that resolves the broker
  socket with the same precedence as defaultLeaseBrokerSocket() in
  commands/launch.ts, and colocates the state file next to it
- broker-supervisor.ts: deterministic path resolution, an idempotent
  apply() that materializes the unit/wrapper/daemon sources (reseed-safe,
  never runs systemctl or starts the daemon), and a health predicate
  (isBrokerSupervisorHealthy / checkBrokerSupervisorHealth) other cards
  (e.g. the C1 activation probe) can call

All tests use temp dirs/fakes; nothing here installs, enables, or
starts anything on this host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/mosaic/framework/systemd/user/mosaic-lease-broker.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=Mosaic lease broker daemon (framework tools/lease-broker/daemon.py)
+Documentation=https://git.mosaicstack.dev/mosaicstack/stack
+After=default.target
+
+[Service]
+Type=simple
+# The broker socket lives under the runtime directory so it disappears with
+# the user session instead of surviving as stale state across logins.
+# daemon.py's secure_parent() fails closed unless this directory is exactly
+# 0700, so RuntimeDirectoryMode is not cosmetic.
+RuntimeDirectory=mosaic-lease
+RuntimeDirectoryMode=0700
+# Remove loader and noninteractive-shell controls before ExecStart loads env,
+# matching the tmux fleet units in this same directory.
+UnsetEnvironment=LD_PRELOAD BASH_ENV ENV
+ExecStart=/usr/bin/env -i HOME=%h PATH=/usr/bin:/bin XDG_RUNTIME_DIR=%t /bin/bash --noprofile --norc %h/.config/mosaic/tools/lease-broker/start-lease-broker.sh
+Restart=on-failure
+RestartSec=1
+
+[Install]
+WantedBy=default.target