Revisit Herdr terminal runtime integration

[devswha]

Context

The fail-closed Herdr terminal runtime integration is implemented in draft PR #57, but it is intentionally deferred from the current release scope. The preserved branch is feat/herdr-terminal-runtime.

Resume conditions

• rerun the Phase 0 compatibility probe against the then-current Herdr release
• obtain the independent architecture/security review required by docs/HERDR-PHASE0.md
• update the pinned version, protocol fingerprint, and adversarial evidence if upstream changed
• rerun the full ChatMux verification matrix before reopening or replacing feat(herdr): add fail-closed terminal runtime integration #57

Current preserved state

• PR feat(herdr): add fail-closed terminal runtime integration #57 passed Node 22 and Node 24 CI
• the implementation supports only the measured Herdr v0.7.5/protocol 17 cohort
• unreviewed versions fail closed

No Herdr integration should be merged until the resume conditions above are satisfied.