Pin IshEmbed v0.4.0-abi.1 soft-shutdown runtime

[jacklv-coder]

What changed

• Pin PocketRoot to IshEmbed v0.4.0-abi.1 / revision 4e311bcea4fe806491e76a23c0e4caeeb1c513bf.
• Adopt wire-v4 typed supervisor and native-backlog errors, accept valid guest exit 17, and fail closed on unconfirmed termination or native backlog overflow.
• Update shutdown and smoke behavior for soft-halt/join returning to Swift, .terminated, and the same-process restartRequired contract.
• Refresh Chinese and English integration, testing, roadmap, compliance, and upstream supply-chain documentation.

Why

The previous pin used the v0.3.3 artifact whose shutdown terminated the host process and whose transport encoded failures ambiguously. The self-hosted transition artifact provides bounded native queues, typed terminal errors, and returning soft shutdown without installing or depending on Codex CLI.

Node.js/npm remain optional guest packages. The native Agent Loop/App composition remains paused and is not part of this PR.

Validation

• Codex CR: final pre-push review has no actionable correctness findings (P1/P2: 0).
• swift test: 119 tests, 0 failures, 1 expected RootFS integration skip.
• ./Scripts/check-docs.sh: passed.
• bash Tests/Scripts/RuntimeSmokeScriptTests.sh: passed.
• ./Scripts/build-runtime-spike.sh: arm64 Simulator and unsigned arm64 device final-link passed.
• iOS 18.2 arm64 Simulator native smoke: all 13 checks passed; shutdown recorded returned, terminated, restart required.
• git diff --check: passed.

Remaining gates

• Rerun signed iPhone smoke against v0.4.0-abi.1 when a device is available.
• Physical iPad, minimum Xcode 16, sustained-load/memory, distribution, and RootFS licensing gates remain open.