feat(engine): authenticate primitive connections by spawned PID

[rrrodzilla]

Summary

All primitives connect to the same Unix domain socket and are currently indistinguishable at the IPC level. The engine has no way to verify that a connecting process is actually the primitive it claims to be when requesting subscriptions via system.request.subscriptions.

Proposal

Tie each socket connection to the PID the engine spawned:

• When a primitive connects, use SO_PEERCRED (Linux) or equivalent to retrieve the connecting process's PID
• Match the PID against the ProcessManager's record of spawned child PIDs
• Reject connections from unknown PIDs (or flag them in logs)
• Bind the authenticated identity to the connection for the lifetime of the session, so all subsequent pub/sub operations are attributed to the verified primitive

Motivation

This closes the gap where a rogue process on the same machine could connect to the engine's socket and impersonate a legitimate primitive. Combined with broker-level pub/sub enforcement, this ensures that only spawned primitives can participate in the message bus with their declared capabilities.

Considerations

• SO_PEERCRED is Linux-specific; macOS has LOCAL_PEERPID — need cross-platform abstraction
• This may need to be implemented in the acton-reactive IPC layer
• Consider how this interacts with primitives that fork child processes