PTY systemd supervisor

The root-owned Unix-socket PTY supervisor remains dormant source and is excluded from V2 pilot activation and cutover. Chose direct in-process PTYs under byk over deploying this supervisor because the existing production service already uses that trust model and stronger cgroup containment does not justify a new privileged boundary. Do not add supervisor, helper, readiness-marker, or root-install dependencies to the candidate.