fix(desktop): preserve Multiverse launch community authority

[loganj]

Dependent repair atop #7355 from the completed isolated native run at 110374b. Origin: buzz channel f45d3304-dcf0-44e8-a46d-bcd63b235fbc, thread 16211fefcee85904f49802ce5e1709bf24b4895401a944f0585e70233c4e4d39.

Behavior

• Preserve actual workspace community across Start preflight and shared spawn; runtime-key loopback normalization is bookkeeping, not authorization.
• Read the receiver’s original owner/community Stop/placement database for automatic launch and explicit resume.
• Keep original community through restore/reconcile access probes, launch, and profile sync. No widening of AUTH scope equivalence.
• Regression uses the production receiver/fence path and mock native AppHandle: localhost Stop blocks localhost automatic launch, explicit resume works, newer Stop invalidates its ticket, numeric scope remains distinct.

Evidence

Full native workspace tests passed on this exact source tree: buzz-desktop 3181 unit tests + 10 integration tests; terminal workspace tests also passed. Native Clippy passed. Source formatted and diff checked. Full just ci attempted but the command timeout interrupted an unrelated ACP test after 5 minutes; not represented as a full pass. Frontend and relay product sources unchanged by this repair.

Remaining

The completed native acceptance at parent 110374b FAILED remote Stop before admission; discovery and ordinary local target cleanup/peer survival passed. This repair has not yet received native acceptance. Receiver diagnostics/recovery is a separate descendant repair. New keyless Start/Restart/Move remains unavailable at broker_launch::provision; no successful launch/relocation claimed. Local Stop/reopen follows configured auto-start policy, unchanged. No independent approval, merge, or deployment claimed.

[loganj]

Review/CI disposition at 74c8b33f3db0f94f79ac5463916c8ccab508a055:

Independent review found a P1 not fixed by literal launch/fence preservation: ManagedAgentRuntimeKey still folds distinct loopback community authorities, so live Start adoption and ordinary Stop selection can cross communities. A scoped runtime identity + legacy receipt provenance repair is underway. This draft is not approved.

The current smoke shard 2 failure is huddle-transcription.spec.ts:759 (voice menu not visible at line 819). I reproduced the same failure locally on composed 8c21ecb0 and on earlier ancestor 3f50260bcdf05c224402fa705b94017cbd990166, without source edits. It therefore predates these repair drafts; no assertion was weakened. The separate older workflow-local-controls failure did not reproduce on either local comparison. Other current CI jobs remain running.

[loganj]

The runtime bookkeeping/provenance follow-up is now drafted separately as #7365 at 76fb1e66287b186b54b09e5b73bbd45e3bd7a551, stacked after receiver #7364. This preserves the existing heads while completing the discovered authority defect family. Do not treat this launch-community slice alone as sufficient runtime isolation: the full repair includes #7365's host-preserving runtime keys and fail-closed live legacy-receipt handling.

Full composed native package, Clippy, formatting and file-size gate passed; frontend and mounted evidence is recorded in #7365. Independent final delta review and exact candidate CI/native acceptance remain in progress. This is not merge approval or new keyless-launch acceptance.