Keep NODE_TOKEN out of agent sessions on the local

Supersedes draft 10157. Security-relevant (found by Task 10132's security review). Reproduction: on the container node (`infra/local-edition/Dockerfile.node`: `USER jaah`, `JAAH_SESSION_USER=jaah`) and the native unit (`infra/local-edition/node/jaah-local-node`, runs as the installing user), jaahd and every agent session share one uid; `node.env` holds `NODE_TOKEN` 0600 owned by that uid, so any agent session can read it and call the node-scoped API as the node, bypassing the credential-socket boundary. Fix: in the container node, run agent sessions as a second uid (e.g. `jaah-session`) and keep `node.env` readable only by jaahd's uid — or have jaahd read the identity at start and hold it in memory only, out of every session's reach. For the native unit (no sudo), either keep the token out of anything a session can read or record it as an accepted limit of a single-user install in `tools/local_edition/README.md`. Out of scope: the cloud fleet node layout. Done means: - In the container node, an agent session's read of `NODE_TOKEN` is refused (test or recorded reproduction cited). - The native-unit decision is recorded in `tools/local_edition/README.md`. - jaahd suite and `./dc check quick` green.

Container node now runs sessions (jaah) and jaahd as two uids, and the daemon scrubs NODE_TOKEN from its env; a session's read of the token is refused (proven live). Native unit's one uid recorded as an accepted limit. Quick gate and jaahd suite green; PR #6963 merged (5949f8d0c). Dev deploy failed on a runner workspace fault (draft 10185), not the diff; fleet variant filed as draft 10192. Memory: none applied.