[Fectivnfy112357]

Part of #254. Stacked on #262 (feat/miniapp-loopback-guard), which is stacked on #261. Merge top-down;
GitHub retargets each PR as its base merges.

Change

Two clients share one data directory (ADR 0006), and a Mini App's port is derived from its plugin id, so
without a rule both compute the same first port and the second starts a second process over the same
plugin data. This PR decides ownership rather than arbitration: one client owns a Mini App at a time, per
Mini App.

• Ownership is an exclusively bound endpoint in the Mini App's own plugin data directory — a socket
  file on POSIX, a named pipe on Windows, named from the plugin id. Binding is the ownership: a second
  bind fails while the owner lives, and the operating system releases it when the owner dies. A record
  beside it states which client holds it and since when, so record present, nobody listening is stale by
  definition rather than by timestamp.
• A crashed owner is reclaimable: the dead owner leaves the socket file behind, so a failed bind is
  told apart from a leftover by connecting — a refused connection proves it is stale, and only then is it
  removed and the bind retried once. Nothing is unlinked before the first bind attempt, which is why this
  does not copy the OAuth lease server's path cleanup.
• The refusal precedes spawn: prepareRuntime takes ownership before the port loop and before any
  spawn, and a held endpoint raises OWNED_ELSEWHERE naming the holder
  (Mini App <id> is already running in <client> (pid <pid>)). The acquisition is released on stop, on a
  fatal abort, and on any failure between taking it and returning a runtime.
• A Mini App running outside the record — including one the desktop client started, which writes no
  record — is detected by probeMiniAppPortOwnership, which answers free | guarded | foreign from the
  guard's own answer rather than a bare connect, so a stray listener is never mistaken for a Mini App.

ADR 0020's ownership section now records the mechanism and the reason the endpoint is never unlinked
first.

Validation

• pnpm typecheck — passed
• pnpm run test:capabilities — 237 files, 5833 passed, 18 skipped
• pnpm check:source after node scripts/source-inventory.mjs --write — 5457 files, passed
• New suites: test/unit/miniapp/owner-lease.test.ts (5 cases) and the ownership cases inside
  test/unit/miniapp/loopback-guard.test.ts (3 cases) and node-runtime-credential.test.ts (1 case)
• The refusal-before-spawn case asserts the second child receives no init message
• NOT RUN: pnpm verify in full; browser and release-package steps are left to CI

Not in this PR

Reporting the refusal in the plugin catalogue's apps area and the picker. That moved to #256 with your
agreement — the WebUI's Mini App service is not enabled yet, and ADR 0020 requires the service cell, the
presenter and the view to land as one change. #256 receives the readable refusal this PR produces.

Publication and contribution checks

• I have permission to contribute these changes under the existing licenses applicable to the changed files/packages; imported material and its provenance are identified and existing notices are preserved.
• No credentials, account data, real user content, internal source history or private review material is included.
• Added/removed source files were reviewed before regenerating release/public-source.json; new tests are declared in test/vitest-suites.json where applicable.
• Shared English/Chinese documentation and capability/verification records are updated where applicable. Mock/offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope or license changes: none.

Shared-source port: not needed — the endpoint naming follows this repository's own
@mavis/oauth-lease-protocol convention rather than copying internal code.