Architecture WS9: physical root-pass moves for daemon-diagnostics-scope, runtime-command-surface, runtime-factory #3294

Part of #3276. Reconciliation between ADR 0033 (PR #3287) and the root-zone classification (PR #3288), per the maintainer design follow-ups:

• refactor(move): collocation batch 1 — allocator contract into managed-allocation #3287 (comment)
• refactor(layering): rank every root module so R5 sees through (root) #3288 (comment)

Purpose

daemon-diagnostics-scope.ts, runtime-command-surface.ts, and runtime-factory.ts were marked "move (root pass)" in ADR 0033. #3288 assigns them logical zones only; the files physically remain under src/. Reclassification is not completed collocation — the physical moves remain outstanding, and closing #3280 must not silently complete this promise.

Required behavior

For each of the three files, perform the physical move (or merge) into its owning zone/package with import fixes, in refactor(move) PRs, and delete the corresponding per-file row from ROOT_MODULE_ZONES in the same PR where directory/package-derived ownership replaces it (the maintainer's bridge rule: coherent groups acquiring physical homes remove filename rows; an internal rename within an owner should eventually need no central ownership-table edit).

Done when

• All three files physically live in their owned locations; ROOT_MODULE_ZONES no longer lists them; layering gates green.
• ADR 0033 rows updated to moved with links; Architecture WS5: collocation decisions and first refactor(move) batch #3281 checklist items closed.
• Public export surface unchanged unless the production-exports gate proves otherwise.

Constraints

• One file group per PR; rename-only proofs via git diff -M90% --stat.
• Follow docs/agents/pull-requests.md.