PTY supervisor MainPID authentication

Chose connection-lifetime pidfd authentication plus an invocation-bound assertion immediately before StartTransientUnit over one-time SO_PEERCRED/PID checks because socket descriptors can be inherited or transferred and PIDs can be reused. Verify exact UID/GID, active systemd MainPID, InvocationID, and service cgroup; keep the CLOEXEC pidfd open through the privileged start. Peer credentials alone identify the original connector, not the process currently possessing a delegated connection.