Add disposable native acceptance for owned demo recovery

Exercise actual systemd and Caddy with a changed executable, distinct persistent data, delayed synthetic failure, observer loss and TERM during full rollback. Keep 300-second clocks, exact-source and cleanup receipts; no production credential or worker system privilege is added. Update the connected recovery contract and policy assertions, and retain bounded service identity observations.

Change-source: pulse-maintainer

.github/workflows/demo-runtime-native.yml

@@ -0,0 +1,43 @@
+name: Demo transaction native acceptance
+on:
+  pull_request:
+    paths:
+      - '.github/scripts/demo-runtime-transaction.py'
+      - '.github/scripts/dispatch-demo-runtime.py'
+      - '.github/scripts/tests/demo_runtime_native.py'
+      - '.github/workflows/demo-runtime-native.yml'
+  push:
+    branches: [main]
+    paths:
+      - '.github/scripts/demo-runtime-transaction.py'
+      - '.github/scripts/dispatch-demo-runtime.py'
+      - '.github/scripts/tests/demo_runtime_native.py'
+      - '.github/workflows/demo-runtime-native.yml'
+permissions:
+  contents: read
+concurrency:
+  group: demo-native-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  native:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    steps:
+      - name: Check out exact source without retained credentials
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Prepare Caddy only in the disposable public CI runner
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends caddy openssl
+      - name: Exercise real systemd Caddy and retained child recovery
+        run: sudo --preserve-env=GITHUB_ACTIONS,RUNNER_ENVIRONMENT,GITHUB_SHA,GITHUB_RUN_ID,GITHUB_RUN_ATTEMPT python3 .github/scripts/tests/demo_runtime_native.py
+      - name: Retain sanitised terminal receipts and cleanup
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: demo-native-${{ github.run_id }}
+          path: demo-native-result.json
+          if-no-files-found: error
+          retention-days: 14