R15E: add offline monotonic boundary reconciliation

[bitmaster162]

Summary

• add deterministic offline monotonic-boundary reconciliation for R15 crash windows
• separate read-only planning from explicit apply using an exact plan_hash
• never re-execute the subprocess and never auto-retry a recovery action
• classify hardware/local state as NEEDS_EXACTLY_ONE_EXTEND, APPEND_EXACT_RECEIPT_ONLY, ALREADY_RECONCILED, HOLD_DIVERGED, or OUTCOME_EVIDENCE_REQUIRED
• require the unreconciled boundary to remain the current ledger frontier
• retain external witness locking and existing fail-closed runtime behavior
• keep .receipt_failures.jsonl advisory only; it cannot establish subprocess outcome authority

Exact patch identity

• base: 73ff739f422dd8b9e1a475c3b248b1a25cfe9b66
• head: d5dc4a255b6c8f717337f1c14c139ebbe4ad95c2
• tree: 6e8725e9823980ba288c141e35755d8143a4071d
• 1 commit ahead / 0 behind
• files: 2
• diff: +559 / -2
• patch bytes: 26886
• patch SHA-256: 5c832b06393fdd5c13c4312cb3c7663d077fbbe4b4861df3008961472d9866de

Validation

• R15E focused regressions: 8 passed
• expanded governance suite: 300 passed, 1 skipped
• full repository: 2322 passed, 2 skipped, 19 subtests passed
• git diff --check: PASS
• py_compile: PASS

Exact-head CI

For d5dc4a255b6c8f717337f1c14c139ebbe4ad95c2:

• Ubuntu / Python 3.11: SUCCESS
• Windows / Python 3.11: SUCCESS
• Analyze Python: SUCCESS
• offline-shadow-continuity: SUCCESS
• CodeQL: SUCCESS
• P0 Unified Shadow Continuity: SUCCESS
• review-gates: SUCCESS
• reviews: 0
• review threads: 0

Recovery semantics

Hardware at previous durable digest

• plan: NEEDS_EXACTLY_ONE_EXTEND
• apply may perform exactly one deterministic extend for the already-bound boundary
• no loop and no blind retry

Hardware already at deterministic expected digest

• plan: APPEND_EXACT_RECEIPT_ONLY
• second extend is forbidden
• only the exact deterministic receipt may be appended

Hardware at any other digest

• plan: HOLD_DIVERGED
• no mutation is allowed

STARTED boundary with no verified terminal outcome

• plan: OUTCOME_EVIDENCE_REQUIRED
• the system does not guess, fabricate, or infer subprocess outcome

Already durable boundary

• plan: ALREADY_RECONCILED

Live GEN3 authority state

Read-only validation before/after tests showed the current live authority files unchanged:

• ledger: b9fb685aa6497db94c896146e1f7615f594a2dd4d6ba1090d2c578e61c31351b
• registry: 932a94b0786a5461c26aa72b02f70f0a2deec780f700a7b6f36ab61fd000e395
• witness: 8129f32d6971f425026de449f13158bf74702181332e704958c4f5e55422130e
• controller profile: d732c991382a2edb99b9dcb39063224c2a62df2c56813668e76a74444c2965d4
• custody: 49332781cffda2e7aec3a5ab7d41f4f0cd7b880ba2118b2e29492fb049917b98
• current GEN3 TPM digest remains 3a98c18dff65635c51e24e40458d7b1591acfcdc0eca02be30b077c215f58956

Authority boundary

This PR does not authorize or perform live reconciliation apply, live ledger/witness writes, TPM/NV writes, subprocess execution, bind_genesis, DefineSpace, primer, Clear, Undefine, reboot, deploy, trading, capital actions, branch deletion, or merge.

Ready-for-review transition authorized after exact-head CI became fully green. Merge remains separately gated and is NOT authorized by this transition.