Add authenticated native broker adapter

[dovvnloading]

Summary

• add a transport-only Windows named-pipe adapter for the reviewed broker contract
• enforce a protected local DACL, remote-client rejection, expected PID and OS token binding
• derive directional session keys with X25519/HKDF and close on protocol, identity, authorization, or I/O failure
• add adversarial handshake/lifecycle tests and update Phase 2 ADR evidence

Scope boundary

This PR does not launch processes, install or stage bundles, decode images, provide a sandbox/provider, or enable an execution route. The next planned gate is signed bundle installation/update.

Verification

• Python: 164 passed, 1 native-platform skip, 1 pre-existing pytest-asyncio warning
• Native focused suite: 9 passed, 1 skip
• Frontend: 39 tests passed; lint, typecheck, and production build passed
• compileall, contract generation, and git diff --check passed