docs: freeze CK-07R1 lifecycle run-invocation authority

[douglasmonsky]

Summary

• Freeze the CK-07R1 lifecycle run-invocation authority from exact base e0ee9f2cf442399633d93e402d17f527da604f0f.
• Bind the exact command, retained worktree/cwd, interpreter/environment, output nonexistence rule, fixture identity vocabulary, profiles/counts/seed, TailLimits, reachable planner/recovery/PublicationWriter path, process evidence, token timing, and no-retry semantics.
• Preserve prior identities, the writer-only receipt, budgets, package ceilings, PR CK-07R1: correct lifecycle preparation scale #394 stale-read-only policy, and the unspent unavailable one-run gate; keep CK-07R1 and downstream work blocked.

Constraint

The retained candidate is blocked: it exposes an in-process benchmark path but cannot support one explicit launch without behavioral implementation. This PR freezes authority and tests only; it does not implement runtime/harness behavior or execute production/E2E qualification.

Validation

• Focused authority/scope/documentation tests: 50 passed.
• just v: passed; 1,368 tests plus invariant performance, type, lint, and release checks.
• just vc: passed; package build and distribution release-safety checks included.
• GitNexus staged change analysis: low risk, no affected processes.

Hosted CI must pass all required jobs before squash merge. Attach exact-main verification after merge; no merged SHA is claimed here.