Route external results through authority supervisor

[areshand]

Summary

• route orchestrator complete --external-only --result-file PATH through the existing authority-supervisor socket
• preserve the supervisor-owned lifecycle completion boundary
• reject incomplete or unsupported completion argument forms

Production finding

The GitHub E2E session github-pr-e2e-0826e gathered and independently reviewed the correct prod-mcp evidence and persisted the correct caller result, but failed because the authority router recognized the old external-only command shape and not the new result-file form. The command therefore executed under the orchestrator UID and was correctly rejected by the lifecycle gate.

Validation

• cargo fmt --check
• cargo test (59 passed)
• cargo build
• node --test control-server/test/*.test.mjs (10 passed)
• bash tests/run.sh
• bash tests/mock_orchestration_e2e.sh
• git diff --check