fix(daemon): bound materialized-path retention
Summary
Reject unsupported retained-path lifetimes before filesystem, timer, device or uploaded-artifact ownership work. Accept integer durations from 1 to 2,147,483,647 ms. Derive structured input bounds from the flag declaration and use one daemon validator at HTTP, handler and registry boundaries.
14 files changed. Scope now includes HTTP input validation, upload preservation and its compatible wire acknowledgement. Closes #4372; part of #4368.
agent-device install-from-source ./app.apk --retain-paths --retention-ms 60000
Validation
Current head f06ca7db2f4b61f7a4fa478951c7a75a1f572067 passed all 12 runnable exact-head affected checks (exactCommit: true, checkoutChanged: false), including the full unit fallback and corrected layering check. Receipt and skip owners.
Measured HTTP proof: prior 999c8a9 production 2 failed/2 passed → corrected production 4 passed. Existing core/provider/schema proof remains attributed to 999c8a9. The coordinator reviewed the original worker diff; independent Terra review of 999c8a9..f06ca7d found no issues. All review threads are resolved.
No live device run: host retention and early rejection preserve valid device operations. CI-owned/manual lanes and skipped tests are not local passes. No budgets, gate selection, or #4050 fallback were relaxed. No merge is authorized.