Gateway startup, process-boundary, and daemon ownership invariants

CLI startup alone owns StartOptions.processBoundary because signals and shutdown affect the host process; embedded plugins never request lifecycle control. Quiet in-process callers use { quiet:true, local:true }, route notices through file logging, and must not write lifecycle text into full-screen TUIs. Local mode clears hosted and remote-gateway state before validation so process-wide defaults cannot disable local discovery, imports, configuration, or watching. Daemon records contain pid, processIdentity, and an owner-only token: PID reuse makes numeric ownership insufficient. Reuse, termination, and discovery cleanup require the exact recorded generation, and records are removed only while every identity field still matches.