Bounded versioned OTP Port client for the privileged external isolation launcher.

Each request uses an independent launcher daemon process. Domain state is persisted by the launcher and revalidated on every lifecycle request, so a blocked exec can never serialize or delay a concurrent cgroup destroy/freeze operation.