board #629 — user-readable lifecycle contract, planned for Hub .110

Implemented scope: additive user-only managed/adoption projection on GET /api/nodes,
GET /api/node-lifecycle-requests?kind=adopt|start|stop with exactly one of
request_id or node_id (latest request), user-only adopt_capable projection on
/api/host-supervisors. Use existing node read permissions and network scope.
Never expose tokens, process environment, workdir or configuration snapshots.
Candidate discovery is separate child board #654; app PR #733 waits for this.

Validation (2026-10-06; product 999f2e3b350e22ce9bf00093723303f06e4b0e3d):
- Independent tests/test629-lifecycle-read/Dockerfile, no source mounts and
  --network none: real HTTP Hub port 0, fresh HOME and database per invocation.
  11 tests / 84 assertions pass, rc=0. Fixtures never contact real nodes/Hub.
- Removing the common addAgentNetworkScope call makes the named cross-network
  and same-network restricted-viewer HTTP tests fail, rc=1. Restoring the
  implementation returns all 11 tests to green. RESULT PASS.
- Checks include actual created/adopted/none provenance; pending/refused/revoked
  bindings; start/stop state updates and refusal codes; mismatched request/node
  networks; grant/revocation; no new daemon/master-token surface; URL-token
  rejection; capability true/false/absent; empty/duplicate/ambiguous selectors.
- Existing /api/nodes fields and dispatch paths unchanged. New fields require
  header user auth. No new schema, capabilities for node tokens, or write API.
- Docker symbol-pins: docs 17 scanned, 9 judged, 8 skipped; docs-site 18 scanned,
  16 judged, 2 skipped. Missing refs 0, drift 0, rc=0 for both. Skips are not
  verified pins. The first attempt used a no-git image; it was NOT accepted as
  full evidence and was rerun with git plus read-only full repository access.
- test831 built with CI SOURCE_COMMIT/RUNSH_BLOB arguments on 15f185bf (same
  server.ts as final product): L0-L8 RESULT PASS, rc=0. Subsequent changes only
  harden query selectors/test and clarify header auth in the existing docs.
- Docker base-image, bun-install, suite-registration, QA path symmetry/trigger,
  query-token and timestamp ratchets: rc=0, no new exemptions or floor changes.
- Complete server non-root test798 on final product 999f2e3b: built the exact
  Dockerfile with SOURCE_COMMIT and RUNSH_BLOB; no source mounts, network none.
  198/198 files executed, failed_files=0, RESULT PASS, rc=0. Built-in registration
  password-floor mutation witnessed red rc=1. Earlier 299451fc and 15f185bf also
  passed 198/198, but final acceptance is explicitly bound to 999f2e3b.
- GitHub checks remain pending at handoff; local evidence is not a remote gate
  pass. The following report-only commit does not change product/test sources.
No release/version bump, production access, or merge.
