BAZ-016: enforce harness runtime boundaries

[rullopat]

Summary

• enforce current harness policy at HTTP and Telegram ingress/egress boundaries
• make scheduler trigger and inbox claims atomic under lifecycle leases
• add the disabled contract-version release gate, health signals, migration, and exhaustive boundary tests
• document the as-built result and move BAZ-016 to done

Verification

• pnpm vitest run apps/daemon/test/core/runtime-boundaries.test.ts apps/daemon/test/lib/harness-contract.test.ts apps/daemon/test/lib/telegram-routing.test.ts apps/daemon/test/lib/telegram-mirror.test.ts apps/daemon/test/routes/communication.test.ts apps/daemon/test/routes/misc.test.ts apps/daemon/test/core/triggers.test.ts
• pnpm test (91 files, 714 tests)
• pnpm typecheck
• pnpm --filter @bazilion/web typecheck
• pnpm lint (existing warnings only)
• pnpm build
• pnpm --filter @bazilion/web build
• git diff --check

Enforcement remains off and compiled management contract version remains 0 pending BAZ-017.