feat(headless): establish portable Linux host boundary

Add the presentation-free acdream-headless executable, strict no-connect configuration validation, dependency and assembly guards, and a Windows/Ubuntu CI lane that builds and tests only the portable runtime closure.

Co-authored-by: Codex <noreply@openai.com>

.github/workflows/headless-portability.yml

@@ -0,0 +1,97 @@
+name: Headless portability
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/headless-portability.yml"
+      - "AcDream.slnx"
+      - "src/AcDream.Core/**"
+      - "src/AcDream.Core.Net/**"
+      - "src/AcDream.Content/**"
+      - "src/AcDream.Plugin.Abstractions/**"
+      - "src/AcDream.Runtime/**"
+      - "src/AcDream.Headless/**"
+      - "tests/AcDream.Core.Tests/**"
+      - "tests/AcDream.Core.Net.Tests/**"
+      - "tests/AcDream.Content.Tests/**"
+      - "tests/AcDream.Runtime.Tests/**"
+      - "tests/AcDream.Headless.Tests/**"
+  push:
+    paths:
+      - ".github/workflows/headless-portability.yml"
+      - "AcDream.slnx"
+      - "src/AcDream.Core/**"
+      - "src/AcDream.Core.Net/**"
+      - "src/AcDream.Content/**"
+      - "src/AcDream.Plugin.Abstractions/**"
+      - "src/AcDream.Runtime/**"
+      - "src/AcDream.Headless/**"
+      - "tests/AcDream.Core.Tests/**"
+      - "tests/AcDream.Core.Net.Tests/**"
+      - "tests/AcDream.Content.Tests/**"
+      - "tests/AcDream.Runtime.Tests/**"
+      - "tests/AcDream.Headless.Tests/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  portable-headless:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install .NET 10
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Build presentation-free closure
+        shell: pwsh
+        run: |
+          $projects = @(
+            "src/AcDream.Plugin.Abstractions/AcDream.Plugin.Abstractions.csproj",
+            "src/AcDream.Core/AcDream.Core.csproj",
+            "src/AcDream.Core.Net/AcDream.Core.Net.csproj",
+            "src/AcDream.Content/AcDream.Content.csproj",
+            "src/AcDream.Runtime/AcDream.Runtime.csproj",
+            "src/AcDream.Headless/AcDream.Headless.csproj"
+          )
+          foreach ($project in $projects) {
+            dotnet build $project -c Release
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          }
+
+      # AcDream.Core.Tests still contains historical App integration fixtures,
+      # so it is deliberately not a member of this no-App restore lane. Core is
+      # built directly above and exercised through every portable downstream
+      # test project below; the complete solution lane retains Core.Tests.
+      - name: Test presentation-free closure
+        shell: pwsh
+        run: |
+          $projects = @(
+            "tests/AcDream.Core.Net.Tests/AcDream.Core.Net.Tests.csproj",
+            "tests/AcDream.Content.Tests/AcDream.Content.Tests.csproj",
+            "tests/AcDream.Runtime.Tests/AcDream.Runtime.Tests.csproj",
+            "tests/AcDream.Headless.Tests/AcDream.Headless.Tests.csproj"
+          )
+          foreach ($project in $projects) {
+            dotnet test $project -c Release
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          }
+
+      - name: Verify CLI without connecting
+        shell: pwsh
+        run: |
+          dotnet run --project src/AcDream.Headless/AcDream.Headless.csproj -c Release -- --help
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          Set-Content -LiteralPath headless-k0.json -Value '{"version":1,"sessions":[]}'
+          dotnet run --project src/AcDream.Headless/AcDream.Headless.csproj -c Release -- validate --config headless-k0.json
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }