Add Remote session foundations and feasibility checks

Add opt-in Tentacle protocol 1.1, explicit remote grants, lifecycle IPC and expiring core leases in both SDKs. Revoke access before update preparation, including failed updates.

Add transient secret entries, shared Braille cell export and isolated Xorg recovery experiments with focused tests and documented limitations. Production consent, desktop services and live interoperability remain pending.

cmd/tentacle-host/main.go

@@ -11,6 +11,7 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"strings"
 	"time"
 
 	"git.stormux.org/storm/cthulhu/internal/tentacle"
@@ -29,6 +30,8 @@ func run() (runError error) {
 	presentation := options.Bool("presentation", false, "grant command speech/braille result capability (prints JSON only)")
 	interactive := options.Bool("interaction", false, "grant internal form/clipboard/focused-item capability (prints initial JSON only)")
 	readerSettings := options.Bool("reader-settings", false, "grant declarative reader settings capability (prints initial JSON only; does not modify a reader)")
+	sessionEvents := options.Bool("session-events", false, "negotiate protocol 1.1 lifecycle transport without desktop services")
+	remoteGrants := options.String("remote-grants", "", "comma-separated install grants for protocol 1.1; grants do not issue session consent")
 	command := options.String("command", "echo", "registered command to invoke")
 	if err := options.Parse(os.Args[1:]); err != nil {
 		return err
@@ -53,7 +56,11 @@ func run() (runError error) {
 	}()
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
-	session, err := manager.Start(ctx, tentacle.Spec{ID: "local-example", Program: options.Args(), Presentation: *presentation, Interaction: *interactive, ReaderSettings: *readerSettings})
+	var grants []string
+	if *remoteGrants != "" {
+		grants = strings.Split(*remoteGrants, ",")
+	}
+	session, err := manager.Start(ctx, tentacle.Spec{SessionEvents: *sessionEvents, RemoteGrants: grants, ID: "local-example", Program: options.Args(), Presentation: *presentation, Interaction: *interactive, ReaderSettings: *readerSettings})
 	if err != nil {
 		return err
 	}