refactor: Add guarded setup publication primitives (#14460)
Prepare the frozen setup executor with guarded publication and
authored-pin validation before storage or network activity.
Builds on merged #14456. The remaining change targets `main` and stays
below 800 changed lines.
```text
Captured native sources + lock
→ Snapshot-bound writer guard
→ Authored manager integrity preflight
→ Verified, complete installation staging
→ Recheck caller preconditions
→ Select one inventory generation
```
- Bind writer guards to repository filesystem identity and reject
foreign guards.
- Validate locked Node requests and applicable package-manager integrity
without resolving upstream metadata.
- Check caller preconditions before both unchanged and changed inventory
outcomes.
- Share the real setup dispatcher and bounded owned fixture support with
the follow-up CLI implementation.
- Preserve existing non-setup dispatch and inventory behavior;
provisioning and managed-run capability advertisement remain separate.
Refs TURBO-6330.
