feat(sdk): add the typed TypeScript client

[SarthakWade]

What this changes

Adds a generated, zero-runtime-dependency TypeScript SDK to @lockintime/headless. It provides typed host and session clients, private Unix-socket transport, schema-derived validation and timeouts, untrusted-content wrappers, capability negotiation, structured errors, cancellation-aware verified installation, and supervised host ownership.

The launch API preserves the platform default when presentation is omitted and inserts an explicit foreground or background option only when requested on macOS.

Closes #164

Security and lifecycle

• Enforces the Swift runtime directory, socket owner, and socket mode contracts.
• Rejects unknown commands, parameters, unsafe session names, malformed frames, oversized responses, and protocol or response-ID mismatches.
• Reports indeterminate post-write outcomes as OperationOutcomeUnknown and does not retry them automatically.
• Exposes authentication challenge IDs and account aliases only.
• Binds supervised ownership to matching startup and socket PIDs, refuses shared-host races, and reaps only its owned launcher.
• Bounds startup output, installer output, downloads, frames, deadlines, and shutdown.

Verification

• TypeScript lint, generation check, compile, and typecheck
• pnpm --filter @lockintime/headless test: 41/41
• pnpm test: 65/65 protocol tests, secure terminal tests, and MCP integration
• pnpm test:runtime
• Linux Docker E2E
• macOS build and protocol suite
• Linux amd64 and arm64 release artifacts
• macOS and multi-platform container release artifacts
• Exact npm package-content allowlist

Stack

This PR is based on #180. Merge #180 first, then retarget this PR to main.

[yashranaway]

Typed TypeScript client follows the Swift schema. Transport is AF_UNIX only, with runtime-dir and 0600 socket checks. Launch uses start --supervised, matches host PID after connect, and reaps only the owned launcher. Auth stays aliases and challenge IDs. Unknown commands and post-write uncertainty fail closed.

CI for this layer is green. Stacks on #180.