host/taint: match peerspeak's second ownership carrier

The consumer half of phase 1 (plan §5.1, impl plan §3). The engine's
tag root becomes a union: `peerspeak.owned` truthy OR `node.name`
starting with `peerspeak_owned_`. Round 8 added the second carrier
because a node property is invisible to the registry `global` event
and recoverable only by binding the node — which is exactly how the
phase-5 gate failed — while `node.name` is announced directly.

The union lives in `local_root_reason`, not in the adapter. Folding
both into the one `peerspeak_owned` bool at the observation boundary
would make each carrier untestable alone, which is the phase-3r
lesson: a gate asserting a value two sources can satisfy gates
neither. The existing `peerspeak_tagged_nodes_…` fixture now carries
both carriers, so it would keep passing if either were deleted; two
new tests pin them individually, and a third pins that the prefix
matches only at the start of a name.

Both literals are now named constants — they are a cross-repo wire
contract with peerspeak, not local naming — and asserted against
tests/fixtures/ownership-tag-contract.txt, committed byte-identical
in both repos. That test also runs the fixture's own worked example
name through the engine, so the shared file cannot document a value
this side does not actually exclude.

Five mutations verified: drop either carrier, loosen `starts_with` to
`contains`, or rename either constant, and exactly the intended test
fails.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/host/taint/fixture.rs

@@ -152,11 +152,33 @@ impl Graph {
         self.node(name, role, app(client, pid))
     }
 
+    /// A peerspeak-owned node carrying **both** ownership carriers, as a
+    /// live one does. `name` gets the real `node.name` prefix so the fixture
+    /// cannot pass on the property alone.
     pub fn peerspeak_node(&mut self, name: &str, pid: u32) -> NodeRef {
+        let client = self.client_of_app(pid);
+        let name = format!("{}{name}_{pid}", super::PEERSPEAK_OWNED_NODE_PREFIX);
+        self.node(&name, MediaRole::StreamOutput, peerspeak_owned(client, pid))
+    }
+
+    /// Carrier 1 alone: the `peerspeak.owned` property present, the
+    /// `node.name` prefix absent. What the engine sees for a node it had to
+    /// bind to observe (v3.5 §6.7).
+    pub fn peerspeak_node_prop_only(&mut self, name: &str, pid: u32) -> NodeRef {
         let client = self.client_of_app(pid);
         self.node(name, MediaRole::StreamOutput, peerspeak_owned(client, pid))
     }
 
+    /// Carrier 2 alone: the `node.name` prefix present, the property absent
+    /// — indistinguishable from an ordinary app in every other respect.
+    /// This is the case that survives the F1 observation defect, and the
+    /// reason round 8 added a second carrier at all.
+    pub fn peerspeak_node_name_only(&mut self, role: &str, pid: u32) -> NodeRef {
+        let client = self.client_of_app(pid);
+        let name = format!("{}{role}_{pid}", super::PEERSPEAK_OWNED_NODE_PREFIX);
+        self.node(&name, MediaRole::StreamOutput, app(client, pid))
+    }
+
     pub fn node(&mut self, name: &str, role: MediaRole, props: NodeProps) -> NodeRef {
         let id = self.id();
         self.node_with_id(name, role, id, props)