CK-07R1A0: freeze lifecycle source-digest authority

[douglasmonsky]

Summary

• Freeze exact-main predecessor preparation.py SHA-256 408d18e44c87da234d220c29298ebac1780e9426e2dce767b0bfc3ae65e8a872 to retained successor SHA-256 d192c858b48e44b5aa7a7e39ef524e5ec2f08085655fe485639f5e875a727aa1.
• Record the retained worker branch/worktree, exact candidate diff identity, allowed lifecycle scope, reachable consumer path, independent truth/tests, and exact-main revalidation requirement.
• Keep the witness read-only, PR CK-07R1: correct lifecycle preparation scale #394 stale_failed_superseded_read_only, and maximum_new_end_to_end_runs=1 unspent and unavailable. Generic or different digest drift fails closed.

Validation

• Focused authority/schema/DAG/scope negative tests: passed.
• just v: passed; 1368 tests and 13 performance-invariant tests passed.
• just vc: passed; package ceilings and release-safety checks passed.
• No preparation.py implementation, production qualification, end-to-end run, downstream Ready/dispatch, worker task, replacement task, or PR CK-07R1: correct lifecycle preparation scale #394 mutation.

Merge policy: squash only after all required hosted CI jobs pass. Exact-main verification will be attached at the merge SHA.