docs: formalize protocol identity and transition to regular-file escalation mailbox

- Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`.
- Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths.
- Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery.
- Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.

docs/protocol/Lazaret.cfg

@@ -9,6 +9,8 @@ CONSTANTS
     PromptCmd = promptCmd
     ShellCmd = shellCmd
     EditedCmd = editedCmd
+    Identities <- IdentitiesFixture
+    SessionAnchors <- SessionAnchorsFixture
     Domains <- DomainsFixture
     Sessions <- SessionsFixture
     Requests <- RequestsFixture
@@ -20,17 +22,34 @@ CONSTANTS
     SessionDomain <- SessionDomainFixture
     SessionFingerprint <- SessionFingerprintFixture
     DomainFingerprint <- DomainFingerprintFixture
+    DomainCoordinatorIdentity <- DomainCoordinatorIdentityFixture
+    DomainSidecarIdentity <- DomainSidecarIdentityFixture
+    DomainSandboxIdentity <- DomainSandboxIdentityFixture
+    SessionCliIdentity <- SessionCliIdentityFixture
+    SessionAnchorIdentity <- SessionAnchorIdentityFixture
+    CoordinatorCertificateValid <- CoordinatorCertificateValidFixture
+    SidecarCertificateValid <- SidecarCertificateValidFixture
+    SandboxCertificateValid <- SandboxCertificateValidFixture
+    CliCertificateValid <- CliCertificateValidFixture
     ConfigSafe <- ConfigSafeFixture
     SandboxIsolationSafe <- SandboxIsolationSafeFixture
     RequestSession <- RequestSessionFixture
     RequestCommand <- RequestCommandFixture
-    CertificateValid <- CertificateValidFixture
-    SignatureValid <- SignatureValidFixture
+    RequestSandboxIdentity <- RequestSandboxIdentityFixture
+    RequestCliIdentity <- RequestCliIdentityFixture
+    RequestSessionAnchor <- RequestSessionAnchorFixture
+    RequestCredentialValid <- RequestCredentialValidFixture
+    RequestSignatureValid <- RequestSignatureValidFixture
+    ApprovalCliIdentity <- ApprovalCliIdentityFixture
+    ApprovalSessionAnchor <- ApprovalSessionAnchorFixture
+    ApprovalSignatureValid <- ApprovalSignatureValidFixture
+    ApprovalCommand <- ApprovalCommandFixture
     AutoRuleMatches <- AutoRuleMatchesFixture
     CommandRequiresShell <- CommandRequiresShellFixture
+    CommandContentSafe <- CommandContentSafeFixture
 
 SPECIFICATION Spec
-\* Fully closed or failed application states intentionally have no successor.
+\* Fully closed application states intentionally have no successor.
 CHECK_DEADLOCK FALSE
 
 INVARIANTS
@@ -39,14 +58,22 @@ INVARIANTS
     SandboxNamespaceIsolation
     OrderedNetworkStartup
     PublishedDomainsReady
+    ExclusiveBootstrapOwnership
+    TeardownNotJoinable
     RegisteredSessionsConnected
     AttachedSessionsValid
     AuthenticatedRequestsOnly
+    RuntimeRoleIdentitySeparation
+    RegisteredSessionIdentityUniqueness
+    LiveRequestIdentityAuthorized
+    DeveloperApprovalAuthenticated
     HostExecutionAuthorized
     AutoApprovalNoShell
     TerminalIsolation
     NoOrphanHostProcess
     StateAnchorOwnership
+    FailedDomainIsolation
+    OrderedFailureRecovery
     ResultDeliveryStateConsistent
 
 PROPERTIES
@@ -54,3 +81,4 @@ PROPERTIES
     RequestEventuallyResolves
     PromptEventuallyRestoresTerminal
     EmptyDomainEventuallyStops
+    FailedDomainEventuallyRecovers