Add runtime identity artifacts for task worktrees

[Fuiste]

Summary

• add a persisted per-task runtime identity with deterministic worktree IDs, Compose project names, port bases, and optional named port aliases
• generate runtime artifacts under each run and inject NIGHT_SHIFT_* variables into setup, maintenance, provider execution, and verification flows
• surface runtime identity details in prompts, status, reports, docs, and QA guidance without adding new CLI flags
• update the demo and test harness to cover runtime identity generation, persistence, and reporting behavior

Testing

• gleam test

[Fuiste]

I found two blocking issues in the runtime identity implementation.

• src/night_shift/runtime_identity.gleam:47-57 derives port_base from sha256_mod(..., 1000), so there are only 1000 possible bases. Because runtime contexts are retained per task, not just used transiently, different tasks in the same run can collide on the same port block. The collision risk is already material well below 1000 tasks (roughly 17% by 20 tasks), so this does not provide the deterministic isolation the feature is aiming for.
• src/night_shift/runtime_identity.gleam:160-164 writes night-shift.env as raw KEY=VALUE lines using absolute paths from the runtime context. If either the repo path or state path contains spaces, the resulting file is not safely sourceable by shell scripts, even though the docs pitch it as a shell/Compose-friendly artifact. The env file needs escaping/quoting rules (or a narrower documented parser contract) before we can rely on it.

[Fuiste]

Addressed the review in 4fa6de9.

• runtime port allocation now probes deterministically across the current run and skips port blocks already persisted by retained worktrees, so tasks in the same run no longer collide on the 20-port block
• night-shift.env now writes shell-safe quoted assignments, and the docs/tests now describe and cover that contract
• reran gleam test after the fixes

[Fuiste]

QA completed on the combined stack branch and the work has been superseded by #35.

What I validated:

• combined-branch end-to-end QA in the scratch repo
• intentional interruption followed by doctor, resume --explain, and resume
• successful verification, provenance/runtime artifacts, and delivery on the resumed run

Closing this PR in favor of the QAed combined branch.