Resolves the silent reattach hazards exposed when shim spec moved from
argv to stdin (issue #434) and hardens the attach boundary:

- Two-line `shim.pid` written by the child in pre_exec captures
  `(pid, start_time)` so recovery can verify identity across PID reuse.
  New `PidRecord` / `PidFileReader` / `PidFileWriter` split: pure codec,
  parent-side I/O, and pre-allocated signal-safe child-side writer.
- `ProcessIdentity::{Verified, Legacy, Absent}` from `PidFileReader::
  process_identity()` becomes the canonical "is this our shim?" check.
- `vmm_attach` now gates on ProcessIdentity (reads PID from the file,
  not the DB cache) and surfaces crashes via CrashReport.user_message
  when an exit file is parseable. PreflightCrashCheckTask removed —
  vmm_attach covers both safety and enrichment.
- `recover_boxes` reconciles via ProcessIdentity first; exit_file only
  matters when no shim is alive. Verified/Legacy with a stale exit_file
  stashes it to `exit.previous` with a warn so the next crash gets the
  canonical slot.
- Successful start stashes any leftover `exit` to `exit.previous` so
  preflight (now in vmm_attach) doesn't trip on prior-lifecycle
  artifacts.
- `stop()` collapsed: one graceful path via `live_state().await` for
  Running boxes, cleanup-only for Configured/Failed/Stopped. The
  state.status pre-filter prevents init_live_state from accidentally
  spawning a new VM during stop.
- `BoxImpl` owns its `BoxFilesystemLayout` (centralizes per-box paths,
  removes open-coded `boxes_dir().join(id).join("shim.pid")` sites).
- `get_execution_plan` returns Result instead of panicking on Unknown
  status; duplicate allow-list guard in init_live_state removed.
- `BoxID::parse` discipline documented: never silently mint, never
  accept identity from in-VM RPC bodies (MEMORY.md REST SDK bug class).

Tests:
- recovery: crash detection (Failed + reason), successful_start stash
  to exit.previous (preserves crash record across restart cycles)
- rt_impl: stop on Configured/Failed must not spawn; stop on recovered
  Running with mismatched fingerprint must not kill foreign process
- All 708 lib tests + recovery (9) + detach (5) + pid_file (9) green.

Out of scope for this PR (filed as follow-ups in plan file):
- Stopped+Verified orphan drain (rare manual-intervention edge case)
- DB-less orphan filesystem scan (recover_boxes only iterates DB rows)
- Feature C — HMAC challenge-response for host↔guest defense in depth

Co-authored-by: zxyasfas <zxyasfas@users.noreply.github.com>