feat: run finite native down hooks around owned teardown

[roodboi]

Summary

Native finite down hooks run in authored order around owned teardown. host.down.before runs before engine stop; host.down.after runs after exact container/network and saved proxy-dispatch absence, with hostname claims still held. A known before failure prevents engine mutations. A known after failure returns the hook's exit status and leaves stop pending. Uncertain effects retain their exact phase, operation, token, generation and claims without replay.

Normal hook-enabled down uses the saved generation's source revision, profiles and overlay selection, with managed target environment delivery and fresh source, ownership and absence checks. Full private selection is reacquired before each phase and final retirement; the other ownership fences use the original source/env owner's freshness check. down --recover skips authored hooks and uses saved ownership even with malformed source or unavailable environment. Completed stops and legacy generations do not acquire newly authored hooks.

Verification

• Final head 53f54377: independent source and launcher review clear; affected tests 179 pass, 0 fail; planning acquisition-count regression passes. Required typecheck, lint/privacy and fresh CLI build pass. Final whole suite: 3604 pass, 73 skip, 0 fail across 333 files. All 13 exact-head hosted CI checks pass, including Docker E2E and both candidate cores.
• Existing state models: 69 positive/negative controls pass with pinned TLC/Java; model bytes are unchanged.
• Final-head compiled M3 maintained native-config-down-hooks scenario passed in 41.1s (1 pass, 0 fail, 0 skip): ordered phases, known exit 17 recovery, malformed-source saved recovery and original-volume retention/cleanup. Preflight and postflight preserved the same daemon and all original container/network/volume identities.
• Separate terminal controls on reviewed head 10514e41 passed stdin, Ctrl-C (130) and fixed 8s timeout (124), with exact host process/group absence before saved recovery. This earlier PTY evidence is separately qualified; it was not rerun on the final head.

Release Signal

feat: optional local CLI capability. Squash title: feat: run finite native down hooks around owned teardown. Publication remains with the repository release workflow.

Semantic Surfaces

Lifecycle shell/process behavior, target environment acquisition and saved runtime-state reconciliation change. Closest controls cover CLI phase/recovery, generation journal/completion, route ownership and the maintained live fixture. Command and generation ownership contracts are updated.

Risks / Follow-up

This finite slice does not complete NC03. Persistent host processes, explicit uncertain-hook recovery and native-provider approval acceptance remain separate. The maintained fixture is unrouted; routed/TLS down-hook live acceptance remains separate. No global DNS, trust, app activation or release action is included.