[P1 before unattended use] Add attributable routes and loop-safe message correlation #37

Summary: Define a trustworthy delivery envelope and supported local execution contract.
Why: textual provenance is caller-authored, not authentication; there is no correlation/loop control; cloud Grok cannot directly access a user Mac socket.
Acceptance criteria: messageId, correlation/reply relationship, and bounded hop/loop prevention in receipts; operator-controlled destination; documented local host/CODEX_HOME/credentials/thread ownership; clear unavailable-route failure; correlated round-trip without ack loops; private Desktop pipes and arbitrary ChatGPT access remain out of scope.

Parent: #24
Source: GPT-6 Pro post-land review of #27/#28 — https://chatgpt.com/c/6aa89f23-6920-83ea-b98a-a1f155a1ae3f