Bind CK-07R1 fallback-persistence successor authority

[douglasmonsky]

What changed

• adds the versioned CK-07R1 shared successor overlay while preserving accepted CK-08R1B, CK-08R1, and CK-QG1 authority bytes
• binds only the exact 66c015de… / f108dbb4… / 4c514889… candidate cohort as worker_prequalification
• enforces exact committed and all-or-none combined-preflight Git deltas
• binds bounded reap, evidence and receipt ordering, lexical interpreter identity, atomic ledger persistence, and signal masking during every terminal fallback persistence call
• keeps runtime acceptance unclaimed, launch blocked, and the one-run token unspent/unavailable

Why

The retained CK-07R1 launcher correction closes the final reviewed fallback-persistence signal race. Shared consumers need a versioned, fail-closed authority bridge before that exact implementation cohort can be considered for worker prequalification.

Validation

• authority consumers: 193 passed
• focused publication/contracts/storage/oracle: 408 passed
• privacy: 9 passed
• just vp, just v, and just vc passed using existing dependencies
• full Python 3.14.6 validation: 1544 passed, 1 skipped
• intercepted exact argv boundary: no real child, matching_processes=[], output/ledger/stdout/stderr absent, token unspent
• exact Git delta/fold/postconditions, schemas, ruff, mypy, compileall, diff check, secret scan, and one bounded independent correction review passed

Python 3.10 remains reserved for hosted CI. This PR contains authority/schema/docs/scope/consumer-test paths only; it does not publish implementation bytes, authorize launch, mutate PR #394, consume the token, create run artifacts, or advance downstream packets.