Reconcile CK-07R1 lifecycle candidate authority

[douglasmonsky]

What changed

• Reconciles the CK-07R1 lifecycle source-digest authority from the live predecessor to the retained successor, binding the supplied preparation, benchmark, lifecycle-test, and linked-evidence hashes.
• Freezes the selected-candidate/no-run state, revoked malformed dispatch value, and exact 720-second wrapper timeout while preserving the existing runtime budgets and historical identities.
• Updates packet/index/scope-facing documentation and exact negative authority tests.

Why

The completed remediation produced a mechanically identifiable candidate, but it has not been runtime-accepted. This change closes the authority identities without claiming an end-to-end result, consuming the one-run gate, or changing harness/runtime behavior.

Validation

• Focused authority/scope tests: 54 passed.
• just v: passed, including 1,368 tests, console typecheck/tests, invariants lane, Pyright, and release checks.
• just vc: passed, including package build and distribution checks.
• Bootstrap and GitNexus freshness checks passed.

Gating and preservation

• No E2E/lifecycle qualification run was executed; the one-run token remains unspent and CK-07R1 remains blocked pending exact-main worker revalidation.
• PR CK-07R1: correct lifecycle preparation scale #394 remains stale failed read-only; the writer-only receipt and all prior run identities remain preserved.
• After hosted CI passes, this PR requires squash merge only. Exact-main verification and any worker resumption remain separate gated steps.