feat(supervisor): advertise accepted application route installations #4939

User Story

I use OpenShell to run sandboxed applications behind independently operated ingress. I need routing consumers to identify the supervisor that has actually installed each service and stop using installations after replacement, withdrawal, or expiry.

Problem Statement

The opt-in app listener in #4666 accepts declarations, but the gateway has no accepted installation evidence to supply to service discovery. A declaration alone cannot identify a safe current backend, especially when HA takeover retains the workload generation.

Impact / Why This Matters

Static owner mappings become stale, and reporting declarations as installed routes could direct ingress to a former owner or an uninstalled route.

Proposed Design

Supervisors report installed declared routes through their authenticated gateway session. The gateway accepts only current-owner reports, resolves reachable app endpoints from trusted driver/operator information, and maintains bounded expiring installation records shared across gateway replicas. Shared Kubernetes backends use the owning member's Pod IP and configured app port; no shared app Service is required.

This supplies installation evidence for #4667 without adding discovery RPCs, a proxy, public URL selection, or controller reconciliation.

Suggested UX

Operators retain the listener configuration from #4666. Installation reporting follows listener enablement automatically; it does not require another public endpoint or user credentials. The later discovery API exposes the accepted records to authorized consumers.

Acceptance Criteria

• Reports prove listener installation and cannot broaden current declarations.
• Current session, supervisor instance, runtime generation, ownership term, and report sequence fence stale writers.
• Endpoints derive from trusted driver/operator state and use the common configured app port.
• Renewal cannot advertise past confirmed serving freshness; empty reports, rejection, replacement, and expiry withdraw routes.
• Shared persistence and mutation guards handle concurrent declaration changes, ownership changes, and cleanup safely.
• Collection, renewal, retained fences, and cleanup work are bounded.
• Poll and push delivery, quiet renewal, delayed/replayed reports, recreation, and HA takeover are covered by tests.
• The layer is demonstrated without public discovery RPCs or a reference proxy.

Alternatives Considered

Static endpoint mappings do not follow ownership. Policy acknowledgement alone does not prove the listener is usable. Gateway data-plane relay preserves the original bottleneck. Middleware, interceptors, and providers do not replace authenticated runtime ownership and installation evidence.

Agent Investigation

Split from #4667 for a PR stack: #4936 listener, advertisements, workspace discovery. HA integration depends on #4864's ownership-term interfaces; runtime generation alone is insufficient. Public API discovery remains #4667 and machine-reader authorization remains #4668.