fix(supervisor-run): reject invalid Runtime tree ownership

[drewstone]

The Runtime strict reader accepted two malformed ownership shapes: one spawn could own both its explicit owned-tree path and its legacy child-id path, and a descendant spawn could be written in the parent tree instead of the tree its parent owns.

This change makes an explicit ownedTreeRoot exclusive, validates each descendant spawn against the tree owned by its parent, and keeps legacy child-id roots only when no explicit owned root exists. Two public-reader regression tests reproduce both false positives.

Checks:

• runtime-reader.test.ts: 18/18 passed
• pnpm typecheck: passed
• pnpm lint: 743 files passed
• pnpm build: passed
• pnpm verify:package: passed
• retained canonical Runtime journal: 24 normalized rows, two nested supervisors, two leaf workers
• pnpm test: 5,707 passed, 39 failed, 3 skipped locally; 37 failures are the known macOS /var versus /private/var temporary-path mismatch, and 2 are unrelated hosted/process-output tests. Linux CI is the release check.