Runtime-agnostic, cross-machine Pinet worker membership #1067

Problem

Pinet workers only join the mesh reliably when Pinet's own launcher starts them. Workers started from an ordinary shell, Rex, SSH, or a manually launched tmux/Herdr pane can fail to register.

Observed root cause:

• slack-bridge/index.ts returns before registering /pinet when Slack bot/app credentials are absent, so /pinet follow is treated as ordinary chat text.
• Followers therefore need Slack credentials just to load Pinet, although they mainly need to reach the broker.
• Subtree spawn works by forwarding broker environment variables, including Slack credentials, through tmux/Herdr launcher scripts. Other launchers have no equivalent bootstrap contract.
• The broker listens on a Unix socket or loopback-only TCP, so the mesh cannot span machines.

Goals

• Run Pinet workers from a normal shell, Rex, tmux, Herdr, SSH and similar launchers with the same behaviour.
• Run one mesh across machines, for example a Mac mini, a personal laptop and a Hetzner VM.
• Prepare the worker model for a future durable Pi runtime.

Proposed design

1. Separate mesh membership from Slack. Only the broker or transport adapters need Slack credentials. Followers need a broker endpoint, mesh credential, stable identity and repo/capability metadata. Missing configuration should produce an actionable error instead of silently skipping /pinet.
2. Launcher-independent joining. Use a protected local profile so every launcher runs the same command, while keeping existing environment/settings configuration working.
3. Cross-machine transport. Workers connect outbound to the broker over a private network such as Tailscale, never a public endpoint. Use revocable per-host or per-worker credentials, preferring short-lived broker-issued sessions to one long-lived shared secret. Keep the Unix socket as the local default.
4. Host runner and runtime adapters. A per-machine host process reports host, repos/worktrees, available runtimes, capacity and health. Runtimes implement a common interface: start, send, read, status, stop and attach command. Shell, Rex, tmux, Herdr and SSH become interchangeable backends.
5. Durable-ready worker state. Track worker identity, connection lease, lane ownership, message delivery/acknowledgement and runtime handle independently of tmux/Herdr details, so a durable runtime can suspend and resume a worker without changing its identity.

The packaged default broker policy should also become runtime-agnostic instead of requiring Herdr.

Acceptance criteria

• A worker started from a plain shell with no Slack credentials registers with the broker.
• The same works through Rex and tmux.
• A worker connecting through a non-loopback private-network endpoint authenticates and registers; unauthenticated or revoked credentials are rejected.
• Existing local flows continue to work, and pnpm lint, pnpm typecheck and pnpm test pass.
• The PR records the tested revision, commands, observed results and untested paths.