refactor(supervisor): separate MCP dispatch from transport

docs/prds/0082-authoritative-failure-boundaries.md

@@ -36,15 +36,6 @@ misleading behavior:
    destructive plan.
 5. Gateway log-pump threads race stream closure during shutdown and emit
    uncaught exceptions even when shutdown otherwise succeeds.
-6. Firecracker discovers VMs through whitespace-split `pgrep -a` output.
-   A configured cache path containing spaces can hide a live VM from the
-   snapshot and make its run directory appear orphaned.
-7. Docker cleanup asks compose for its project snapshot in best-effort mode.
-   A transient query failure can therefore become an empty stopped-project
-   set and authorize deletion of associated state directories.
-8. Firecracker artifact downloads and registry publication have no network
-   deadline, so an unresponsive registry can hold setup or release work
-   indefinitely.
 
 These are one design problem: state used to authorize deletion, replacement,
 or resource allocation must be authoritative at the point of use.
@@ -55,8 +46,6 @@ or resource allocation must be authoritative at the point of use.
   appeared in a pre-confirmation snapshot.
 - Firecracker cleanup proves immediately before action that a PID is still the
   same Firecracker process and that a run directory is still orphaned.
-- Firecracker process discovery reads NUL-delimited argv from `/proc`; paths
-  are never reconstructed from whitespace-delimited process listings.
 - All backend cleanup discovery primitives raise a typed enumeration error on
   operational failure. No backend may independently continue from a partial
   snapshot.
@@ -71,8 +60,6 @@ or resource allocation must be authoritative at the point of use.
   callers because bottles themselves are untrusted.
 - Gateway child-output pumping treats expected stream closure during shutdown
   as completion while preserving diagnostics for unexpected failures.
-- Artifact pull, existence-check, and publication requests use explicit
-  network deadlines.
 - Unit tests cover PID/path reuse, partial backend enumeration, transient
   policy resolution failure, slow bodies, concurrency saturation, and stream
   closure races.
@@ -107,13 +94,6 @@ Backend-specific primitives define how to identify a resource. Firecracker
 uses process start identity plus canonical config/run paths; container
 backends use authoritative CLI queries and stable resource names/labels.
 
-Container engines expose destructive name-based commands without a portable
-compare-and-delete operation. Cleanup therefore refreshes after confirmation
-and requires every discovery query to succeed, minimizing but not claiming to
-eliminate the final name-reuse race. A future engine-specific stable-ID
-primitive may close that residual window without moving control flow back
-into each backend.
-
 ### Enforcement state versus introspection state
 
 Egress enforcement retains its deny-all fallback because uncertainty must not
@@ -144,8 +124,6 @@ reported through the supervisor's normal diagnostic channel.
 5. Shared cleanup refresh/revalidation plus authoritative macOS discovery.
 6. Strict supervisor introspection and bounded supervisor/Git HTTP work.
 7. Gateway shutdown log-pump closure handling.
-8. Lossless Firecracker process identities, authoritative Docker cleanup
-   queries, and bounded Firecracker artifact transfers.
 
 ## Open questions