feat(host): let agents discover and message channels on peer hosts

[iamnbutler]

Native agents' channels and message tools now reach channels on reachable peer hosts, not only the local catalog. Part of #57; draft until two-host acceptance (#10). Dogfooding: #5.

• Workers use host.sock in their host's data directory, authenticate with its owner token, and verify the returned home. Discovery and delivery obey the gateway's shutdown/update rules; conflicting hosts are refused.
• channels lists local channels, reachable peers' channels and offline ones from the directory, with id, host, owner, state and project. A repeated name is refused with the candidate ids.
• message delivers locally or relays once to the peer that runs the channel through a new peer-only deliver request. Peers never forward further.
• The destination host stamps agent.<source id>@<login>, using its owner's login or the peer's Tailscale-verified login. Caller-supplied authors are ignored. Agents are never the owner, so sharing off refuses invocation. The source id is the reply address and survives renames. Relayed request ids are scoped to the verified login; local ids are unchanged.
• Without a running host (CLI-only), workers fall back to local delivery only on ENOENT/ECONNREFUSED, and say so.

Validation

bun types and bun run ci pass. The disposable ace serve --port 4357 profile used real Anthropic models and only disposable channels. Checked: say and invoke, a reply by source id after a rename, name ambiguity, sharing off, replay and peer/local request-id isolation (confirmed in SQLite), and refusals. Also checked: peer delivery over this Mac's own tailnet listener with real whois, socket lifecycle, drain at SIGTERM, and CLI-only fallback. Full record: #57 (comment).

Not verified: two real hosts or a second distinct login. The only online peer Mac had no Ace gateway (ports 4140–4142 refused). Two-host discovery and delivery, collision isolation between distinct logins, reconnect, and directory-listed offline peers remain open.

Built in Ace

Implementation, runtime checks, commit, push and this PR were done inside the Ace channel peer-channel-messaging with its shell and file tools. Codex, outside Ace, audited the source read-only, coordinated this channel and independently reviewed the design and diff, because the Codex harness is not available inside Ace (#9).