Restore source-bound registry simulation coverage

[ob1-s]

Summary

• restore exact source-bound ExecutionSpec recipes for the current Pollen policy-set and defensible community artifacts
• keep unsupported catalog sources fail-closed and preserve failed diagnostic checks as evidence
• add policy-set, identity migration, media/catalog, installability, and regression coverage

Verification

• pinned prepare: 17 covered, Courier not-covered
• root Python: 23 passed
• simulation Python: 37 passed
• Vitest: 17 passed
• typecheck, registry validation, production build, diff check: passed
• all 17 covered entries rendered local media; 13 passed checks and 4 retained measured failures