feat(commands): adopt unified command envelope — msg.origin provenance

Resolve command origin via msg.origin (registry-stamped, default parent) with a
legacy fallback to the previous payload.source/msg.source field. Feeds the
existing mode/allowedSources arbitration unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/commands/handlers.js

@@ -23,12 +23,20 @@ function _gate(source, action, msg) {
     if (!source.isValidActionForMode(action, source.mode)) return false;
   }
   if (typeof source?.isValidSourceForMode === 'function') {
-    const src = (typeof msg?.source === 'string' && msg.source) ? msg.source : 'parent';
-    if (!source.isValidSourceForMode(src, source.mode)) return false;
+    if (!source.isValidSourceForMode(_origin(msg), source.mode)) return false;
   }
   return true;
 }
 
+// Resolve the command origin (control authority: parent | GUI | fysical).
+// The shared commandRegistry stamps msg.origin (default 'parent'); legacy flows
+// carried it as msg.source. Prefer the legacy field when present so existing
+// flows keep working, otherwise use the registry-stamped msg.origin.
+function _origin(msg) {
+  if (typeof msg?.source === 'string' && msg.source) return msg.source;
+  return (typeof msg?.origin === 'string' && msg.origin) ? msg.origin : 'parent';
+}
+
 exports.setMode = (source, msg) => {
   // set.mode is a status-level operation — allowed in every mode by the
   // default schema (incl. maintenance). The gate still fires so an