docs: bind corrected CK-07R1 successor overlay

[douglasmonsky]

What changed

• Adds the versioned shared CK-07R1 successor overlay over exact main cf44f4fd.
• Preserves accepted CK-08R1B, CK-08R1, and CK-QG1 authority/schema bytes exactly while reconciling their consumers with the corrected atomic CK-07 cohort.
• Admits only preparation 66c015de…, benchmark 4b1c62b2…, and lifecycle test 75d03f53… as worker_prequalification / permitted_not_accepted.
• Enforces exact all-or-none combined-preflight Git delta and pins overlay-before-side-effects, receipt binding, post-token failure classification, and bounded TERM→KILL→reap semantics.
• Keeps launch authorization false, token unspent, outputs/receipt absent, PR CK-07R1: correct lifecycle preparation scale #394 read-only, and all downstream packets blocked.

Why

The prior narrow/shared authority could not safely admit the corrected candidate cohort without a versioned cross-consumer bridge and exact dirty-delta enforcement. This change provides that smallest fail-closed authority overlay without including candidate or production-support paths.

Validation

• Authority consumer suite: 108 passed
• Combined focused authority/launcher/publication/contracts: 535 passed
• just vp
• just v: 1502 passed, 1 skipped; performance 13 passed
• just vc
• Python 3.14.6 local; Python 3.10 deferred to hosted CI
• Independent reviewer: no findings
• Exact Git delta, independent fold/postconditions, byte-identity, diff/privacy/secret, command-boundary, process/output/token absence checks passed

No benchmark child was launched and no output, ledger, stdout, stderr, receipt, token consumption, implementation acceptance, PR #394 mutation, or downstream readiness occurred.