feat(acp): enforce machine heavy-run lease

[johnely19]

Summary

• install a per-adapter PATH shim layer when the machine-local heavy-run lease exists
• route builds, full/render test suites, direct node --test, and browser/screenshot harnesses through the lease before execution
• derive lease labels from adapter identity, managed-session nonce, and a per-adapter UUID
• leave non-heavy commands on the original PATH

Why the shim boundary

ACP adapters execute tools internally; Buzz receives session/update only after execution starts. Injecting shims before the adapter process starts is the earliest boundary Buzz controls, and it covers disposable/old checkouts without changing repository scripts or CI.

Verification

• negative control: replacing only the test:render classifier made the scratch-checkout test fail because the held-lease command exited 0 instead of 75
• restored bytes matched the recorded SHA-256
• full committed buzz-acp package suite: 672 unit tests + 9 lifecycle integration tests passed at 3f787c427b9a466dba6ce5ab133c2cc9b1fab697

Buzz issue: 22eb36a5fe5a00b88e3d73083cf7d502a9527ab9082fca2056baf61d93de925d