Prototype an observe-only Durex-Alfred run ledger

## Parent and milestone

- Parent issue: #43
- Milestone: not scheduled; implementation starts after #15 and the contract in #51.

## Problem

The proposed integration has no executable evidence that one Durex run can
start a pinned Alfred observer, publish explicit workspace/session context,
correlate bounded JSONL observations, and retain a reviewable ledger artifact
without confusing observation with policy or causality.

## Outcome

Build an opt-in, single-host observe-only spike that attaches a bounded Alfred
ledger to one Durex run and proves lifecycle, correlation, cleanup, and failure
semantics.

## Scope

- Pin the compatible Alfred revision, approved executable digest, and required
capabilities at startup.
- Create config, logs, and ledger atomically in a private per-run directory
outside the workspace; reject symlinks, unsafe values, and shell execution.
- Generate distinct Durex run, Alfred ledger-session, and workspace identities.
- Start Alfred before the coding-agent process and verify SESSION_CONTEXT.
- Consume bounded JSONL as an external observation stream without parsing it
back into Alfred or treating it as a policy response.
- Persist a hashed ledger artifact reference and explicit coverage/degraded state.
- Stop and reap the owned Alfred process on completion, cancellation, and error.
- Cover unavailable binary, startup timeout, malformed or mismatched context,
queue overflow, early exit, output bound, cancellation, and cleanup.

## Non-goals

- Process-to-agent attribution, preventive blocking, approval decisions, or
arbitrary terminal input.
- Installing Alfred automatically or opening a network listener.
- Sending full prompts, credentials, or hidden reasoning to Alfred.
- Treating inotify coverage as complete filesystem, process, or network evidence.

## Acceptance criteria

- [ ] The feature is disabled by default and validates executable digest,
regular-file ownership, config serialization, and private paths.
- [ ] One run maps to one distinct verified Alfred ledger session.
- [ ] Expected workspace file effects appear in a bounded ledger artifact.
- [ ] Missing coverage and degraded observation are visible and never reported
as successful enforcement.
- [ ] Cancellation and every failure path reap only owned process groups.
- [ ] Targeted failure tests and the complete regression suite pass.
- [ ] Operator, security, recovery, and artifact documentation is updated.

## Validation

- Run a temporary-workspace smoke scenario against the pinned Alfred revision.
- Run fake-observer path-replacement, config-injection, startup, and protocol
failure scenarios plus Durex supervisor, cancellation,
event, retention, and configuration regressions.

## Dependencies

- #51 defines the contract.
- #15 gates runtime implementation.
- #44 and #47 define the future production workspace and artifact boundaries;
this spike must not claim those guarantees.

Start with the contract in #51 and the runtime gate in #15, then review the temporary-workspace smoke scenario and the listed fake-observer and Durex regression suites. Done means the opt-in spike meets the acceptance criteria: bounded ledger evidence, visible degraded state, owned-process cleanup on every path, passing targeted and full tests, and updated operator, security, recovery, and artifact documentation.

Written by the indexing model from the issue text.