Route ACP workers by execution domain

[jmecom]

Adds exact execution-domain binding to the ACP worker pool. In the new enforcement mode, Buzz resolves the turn before pool selection, reuses a child only when its complete execution domain matches, and replaces the child and clears harness-retained state before crossing a domain boundary.

Owner-private core memory is admitted only to an owner-private turn. The existing off path remains unchanged, and the audit-only path continues to log without changing worker reuse.

This layer enforces ACP process and harness-state separation. It still does not claim OS-level isolation of files, credentials, tools, network access, or publication authority.

Testing:

• cargo test -p buzz-acp (824 tests)
• cargo clippy -p buzz-acp --all-targets -- -D warnings

Stack:

1. Audit audience-scoped IFC decisions in buzz-acp #6273: audit-only IFC evaluation
2. Route ACP workers by execution domain #6274: exact-domain ACP worker routing
3. Extract reusable IFC policy and classify worker placement #6275: reusable policy and worker placement
4. Expose IFC policy to external agent harnesses #6176: external harness broker