Discover trusted Intelligence build executors - #159

Outcome

Adds the dedicated, domain-neutral installed executor seam and the invocation-scoped host services required for a durable governed Atrium build. Core selects an exact authorized profile through the ace.intelligence_builders entry-point group; Domain Packs remain inert.

Durable host contract

• public executor request, authorization, effect, and host-service contracts live under ace.application
• the reviewed request approves exactly Connect sources, Map concepts, Activate watch, and Create first Brief; no publication, delivery, or external action
• a separate resource_authority_grant_ref preserves observe_read authority instead of reusing the build grant
• each invocation receives a product-fenced durable ImmutableRecordStore
• Core owns projection from that same store and resolves the exact read authority before returning a page
• the executor receives no raw Core runtime, authority resolver, provider secret, or cross-product store access

Discovery boundaries

• Core discovers only the dedicated executable-adapter group
• duplicate, invalid, or failed executor material fails closed
• unknown profiles return an explicit unavailable result
• ACE_DISABLE_EXTENSIONS=1 keeps the naked kernel free of installed executors
• no domain/package names or implicit authority grants are embedded

Verification

• 27 focused host-service, product-fence, registry, Builder/read API, and architecture tests passed
• 11 naked-kernel and public-boundary tests passed
• Atrium request test and production build passed
• Ruff and diff checks passed

Dependency

Builder start PR #154 is merged. World adapter PR #32 will consume this exact public contract and must prove durable restart/reopen before release.