Verify and enforce client-owned destinations for remote capture stop and report #4518

Umbrella: #4368. The user authorized Claude planning, assumption verification and completion workers, followed by correctness-preserving cleanup. Source authority: main ddbfc85. No runtime proof is claimed. Preserve typed errors, existing command envelopes, #4050 full-unit fallback and meaningful integration/regression/native evidence. Do not merge, release, push tags, weaken assertions or retry failures blindly.

Purpose: A remote response must not choose arbitrary local write destinations when completing an earlier capture.

Source trigger (reproduce first): packages/remote/src/daemon-artifacts.ts resolveMaterializedArtifactPath accepts response artifact.localPath verbatim on record stop, trace stop and perf stop/report when the current request did not register a path. artifact-download.ts writes through createWriteStream and removes the destination on transfer error. Current tests use benign echoed paths; they do not independently establish earlier client authority.

First completion gate: A controlled loopback/provider test must distinguish a client-registered capture destination from a hostile response-only localPath outside it. Prove the actual write boundary using owned temporary paths, with correct artifact/auth/hash responses. If an earlier guard prevents that write, reject or narrow this candidate. Never use a real user file.

Blocked by: open external #4511 touches the same artifact materialization owners. Read its current disposition before scheduling implementation. Do not modify, take over, stack on or duplicate the external PR. No implementation starts until the overlap is reconciled explicitly.

Proposed invariant: Only current or earlier client-owned capture state can authorize a destination; a daemon echo is not authority. Before coding, decide missing-record behavior, capture/session generation identity, restart/another-process behavior, derived report paths and state lifetime at the existing owner. The proposed remote-connection-state field is not yet an adopted design. Do not create a second global store/cache or infer arbitrary paths from untrusted response names. Coordinate publication atomicity with #4511 rather than cloning a helper. Preserve actual caller-chosen path semantics unless a separate finite policy explicitly changes them.

Required proof after contract adoption: Real command-route start/stop/report across processes/cwd, hostile destination and symlink cases at the correct authority boundary, interrupted-transfer destination preservation, generation/session isolation, compatibility trace and independent source review. Run exact-head affected validation with full-unit fallback. This client-only authority change does not require a device unless dispatch/native behavior changes. No runtime reproduction or readiness claim exists yet.