Ingest Worker output and instance events of one app host boot (ADR 0076 contract §5a)

Bearer: an app-host-logs producer token verified before the body is read. Active or draining members may submit up to 64 streams and 500 records. Each stream is bound through the live or retained app route binding; rows are stored in the Workers project logs through the shared write sanitizer and are idempotent per host, boot and seq. The host drops, never retries, a refused batch.