fix authority supervisor privilege transition

[areshand]

Summary

• add a fixed, zero-argument authority-supervisor-exec setuid entrypoint for control UID 10000
• hard-code the supervisor UID, credential group, binary, and serve command
• keep generic role-exec outside the privileged setuid allowlist
• preserve the complete supplementary-group list when dropping identity

Production failure addressed

The trusted launch path spawned the supervisor through generic role-exec. The setuid gate correctly removed privilege from that generic command, causing setgroups to fail before the authority socket could be created. This patch provides the same narrow fixed-command pattern already used by role-agent-exec without exposing arbitrary privileged execution.