Add offline independent-package owner and dual generation lifecycles

[CompleteDotTech]

Adds a finite source-owned console that composes two independently installed Alpha/work-queue packages through one canonical task, signed authority and durable shared ledger. Public planning, source transaction, package/install and connected delivery contracts bind the actual owner and both member origins. Runtime loads only signed captured member source and refuses task, scope, origin, budget and replay drift. The aggregate supports explicitly authorized offline shadow only.

Extends dual-host connected generation transfer to preserve both placements, charges, entrypoint invocation claims and task tombstones across upgrade and retained rollback. These claims describe source-owned entrypoint invocations, distinct from treatment Context actions. Both new actual installed journeys are mandatory in the existing hosted 3.13 gate. Python 3.10 compatibility retains the declared tomli fallback and pre-PEP701 renderer syntax.

Validation on final head 0b7eac7:

• Hosted Python 3.13: 2440 passed, 337 declared skips; all 27 required installed modules completed without skips or failures. The separate Node24 qualification passed its pinned profile.
• Hosted Python 3.10: 2338 passed, 439 declared skips. Actual local 3.10 compiled all 401 Python sources; eight child-install cases passed from its real base interpreter after diagnosing a disposable nested-venv startup failure.
• Fresh local 3.13 owner/dual installed journeys: 2 passed, no skips. Native Node24 tests: 25 passed, no skips.
• Package/manifest validation: 170 schemas, 321 synthetic records, 1451 files; wheel data verified. All eight named/applicable offline demos passed in fresh private directories, including implementation (13 recipes), v11 and v12.
• Independent immutable-head review approved the source and verified manifest/wheel identities. All 34 exact-head remote matrix checks passed.

All provider responses are authored local TLS fixtures. The separate-package fixture declares a 10-second assessment timeout before source review and signing; production/default 2-second behavior and finite call/spend limits are unchanged. A planner-only injected clock isolates the final unsigned revoked-ledger negative; actual signed cutoffs, launch clocks and expired-scope refusals remain unchanged. Live operation, measured benefit, canary/active acceptance, production power-loss qualification and separate-owner generation transfer remain open or unsupported.

Refs #57, #59, #50.