#3622 refactor(replay-port): own the replay backend contract in contracts

Summary

First half of the #3377 replay-backend prep, split from the original PR to stay under the diff budget. Behavior, wire shapes and help text are unchanged; the adapter stays in replay-port. Layer 2 (stacked on this) moves it into the Maestro package as a create(host) plugin.

• New @agent-device/contracts/replay-backend: the replay session and command types (moved from replay-port command-types), the backend capability type, the failure descriptor, and the key-locked ReplayBackendDispatchOptions (a Pick of ReplayDispatchOptions, including killApp from #2749).
• ReplayCommand is derived from ReplayBackendCommand, so the shared fields have one definition; importers were repointed.
• The divergence-failure response moved out of the Maestro failure module into replay-backend-failure.ts in replay-port; the Maestro failure module builds the descriptor and calls it. Existing daemon failure tests cover it unchanged.
• The engine's MaestroDaemonDispatchOptions aliases the contracts type, so the dependency points from the engine to core.

The contracts module is the only place the plugin contract can live: a type import of replay-port from maestro would be a circular tsc -b project reference.

30 files touched. Refs #3377.

Validation

Tested SHA: e59514f4ec.

• pnpm check:affected --run: all runnable checks passed.
• pnpm check:quick and focused vitest (replay-port, maestro, daemon sessions, contracts, CLI, closure budgets) passed.
• Diff: +444/−348 against origin/main.
• Coverage and provider integration are CI-authoritative.

🤖 Generated with Claude Code