Restore LlamafileProvider with a cooperative race-free launcher

[taras]

Outcome

Restore a built-in LlamafileProvider only after a race-free launcher can satisfy XMD's authenticated cooperative service-startup protocol.

Context

#381 removes the existing provider because a raw llamafile/llama.cpp command does not report its bound endpoint through XMD's authenticated readiness record. Allocating a port first, polling a health endpoint, parsing output, or retrying after EADDRINUSE does not meet the service contract: those approaches retain the port-allocation race or can accept a foreign listener.

Required proof

Before restoring the provider, implement or identify a launcher that:

• starts llamafile without a preallocated published port;
• causes the process that owns the listener to report the actual frozen { hostname, port } endpoint using the exact authenticated protocol defined by Replace findFreePort with scoped, replay-safe attached services #381;
• preserves lossless observation before spawn and secret-safe protocol diagnostics;
• fails on premature or post-readiness exit and participates in Effection scoped teardown;
• requires no port probes, health polling, stderr parsing, or arbitrary-command heuristics; and
• is testable with real processes under the supported host runtimes.

The launcher may wrap or supervise llamafile, but it must not weaken service=<binding> for non-cooperative programs.

Acceptance

• The cooperative launcher is race-free under forced concurrent startup.
• A foreign listener cannot satisfy readiness.
• The provider publishes its endpoint only through the invocation-local live overlay.
• Provider middleware closes over that live endpoint from persist ephemeral eval; no endpoint enters durable bindings, interpolation, durable effect descriptions, or the journal.
• Startup failure, unexpected exit, cancellation, and teardown follow Replace findFreePort with scoped, replay-safe attached services #381's service lifecycle.
• Only after those properties are proven is LlamafileProvider restored with production, replay, and cross-runtime tests and current specification text.

Non-goals

• Restoring the pre-Replace findFreePort with scoped, replay-safe attached services #381 findFreePort/daemon/health-polling implementation.
• Making service=<binding> accept arbitrary non-cooperative commands.
• Adding a weaker Llamafile-specific readiness path to the shared service API.

Dependency

• Replace findFreePort with scoped, replay-safe attached services #381 defines and implements the cooperative service contract.

[taras]

Closing by product decision: the built-in LlamafileProvider will not be restored. Any future OpenRouter integration will be designed and tracked separately rather than inheriting this launcher contract.