start orchestrator directly from trusted launch

[areshand]

Summary

• replace the sole launch-time generic role-exec call with a private direct child identity transition
• clear supplementary groups and drop to the fixed orchestrator UID/GID before execing tmux
• expose no new setuid subcommand or caller-controlled identity parameters

Production failure addressed

After the per-session authority supervisor started successfully, launch still re-entered generic role-exec to create the orchestrator tmux server. The setuid gate correctly stripped that generic command, so setgroups failed. The launch process is already the authorized fixed entrypoint and can safely perform this one hard-coded child transition directly.