refactor: enforce explicit wrapper session ownership

[ejgallego]

This PR replaces implicit wrapper-daemon lifetime inference with an explicitly owned, authenticated CLI session whose routing and configuration are frozen in a typed descriptor.

• Make lean-beam ensure --hold the sole wrapper-generation owner, with owner-pipe shutdown, a draining fence for normal teardown, and explicit non-signalling recovery after abnormal state.
• Keep the default control plane in the project .beam directory for scoped sandboxes, while adding exact --control-dir selection and deterministic BEAM_CONTROL_ROOT discovery for advanced coordination.
• Add the supported root-aware request-stream machine interface, scope request identity and cancellation by workspace, and keep raw port and dynamic multi-workspace administration on the generic maintenance broker boundary.