fix(shellwake): restore a persistent shell when its owner comes online after the boot sweep

fixes #228

Daemons boot before endpoints do, so the once-per-generation boot sweep of
releases#78 correctly skips an owner endpoint that is not up yet -- an offline
owner is owed nothing -- and then nothing ever revisits it: the sweep does not
run again this generation, and bringup from offline emits no rest edge, so the
ADR-0048 cascade never fires either. The shell stays down until a `shell cmd`
wakes it or an operator relinks by hand, and whether a node restart strands its
shells is an ordering accident. That is releases#228, reported as "shells are
not coming online with their endpoint".

doyle ruled shape (c) with conditions (releases#228): the reconcile loop now
carries the same per-owner restore body, triggered on owner offline->online
transitions since the last pass.

- The trigger is an EDGE, not the level "the owner is online". A successful
  restore self-limits, because the launch restamps `launched_ms` and the
  corpse-boot discriminant refuses that instance from then on; a FAILING launch
  does not, so a level trigger would retry it every reconcile tick for as long
  as the owner stayed up. The edge bounds it to one attempt per owner-online
  event.
- The refusal arms are carried by construction, not restated: both triggers call
  one `restore_persistent_shells_of_owner` -- persistent-only, owner online, down
  in fact via the derived read, stamp present, launch predates boot, and no boot
  oracle means restore nothing.
- Re-evaluating the conjuncts is safe by construction. `launch_predates_boot` is
  monotone within a machine boot (every launch path restamps, a kill never does,
  `boot_ms` is the machine boot instant), so a later evaluation can only refuse
  MORE. The force-kill ruling of KNOWN-HAZARDS 2.6 is preserved identically on
  the second trigger.
- The edge state is seeded BEFORE the boot sweep. Seeded after, an owner that
  comes online in the window between the two would read as already-online and
  never fire -- the exact miss this closes. Seeded before, the worst case is a
  second attempt at an instance the sweep already restored, which the
  restamped birth stamp refuses -- not the down-in-fact arm, which reads like
  the answer and is not: a launch is not the online switch, so a just-restored
  instance keeps an `offline` record until its bind-shell handshake.
- Each trigger names itself in its event line (`SHELL_OWNER_ONLINE_RESTORED` vs
  `SHELL_BOOT_RESTORED`): the field diagnosis of this ticket was a count of those
  events in a rotated daemon log.
- Mid-generation a watcher can already be armed for the casualty (the reconcile
  start side has no owner-online conjunct), so the edge path stops it before
  launching. The boot sweep passes none: no watcher exists before the first tick.

Also fixes the comment in `spawn_wake_host` that claimed the once-ness protects
the operator-force-kill ruling. It contradicted the ruling `reconcile_once`
records at its own start side, and it is mechanically false -- a shell an
operator can kill this boot was launched this boot, so its stamp postdates
`boot_ms` and the discriminant refuses it. The doc-stage text that stated the
boot sweep as the only trigger is swept with it (CONTEXT.md, KNOWN-HAZARDS 2.7
and its table row, MANIFEST.md Sleep/wake).

Mints and activates REQ-SHELL-OWNER-ONLINE-RESTORE (doc/impl/unit).

The hazard test brings an owner online AFTER a spent sweep with no rest edge
anywhere in the setup, and carries three arms in one fixture: the restart
casualty is restored; a sibling force-killed THIS boot is not; and a second pass
with the owner still online restores a freshly stranded instance not at all
(the arm that tells an edge from a level -- no success case can, since a
successful restore restamps itself out of eligibility).


Co-authored by: todlando