Add durable context recovery and production gates

[AetherAI3]

Cloud host replacement and retention retries need an exact, durable result instead of reissuing effects against short-lived runtime configuration. This adds revisioned reservation release/revival and bind commands, signed checkpoint-durability registration, V2 hydrate/re-attestation with atomic startup result publication, and replay-safe expiry evidence while preserving the existing V1 compatibility path.

The hosted boundary now starts through a source-only pre-import guard, reports measured ContextHealthV3 capabilities, caps live checkpoint packs at 13,000,000 bytes and decompressed snapshots at 16,000,000 bytes, and includes a required Linux Unix-socket memory gate. The measured near-cap run moved 12,775,155 bytes (98.27% of the advertised cap), served 4/4 concurrent small calls, rejected an exact one-byte replay mismatch without mutation, and peaked at 378,978,304 bytes under the service limit. Retention tests cover restart and provider-retirement replay, remote deletion ordering, and immutable receipts.

Validation: 707 passed, 9 skipped on the exact commit; Ruff clean; mypy clean across 24 source files; hosted schema export/reproducibility clean; Windows restore 15 passed/3 POSIX skips; WSL restore 19 passed; reservation lifecycle 25 passed; independent review found no P0/P1 issues.

This is source hardening only. Runtime reach claims remain disabled, and Gate 0, Gate 8, production deployment, live-provider canary, and one-billion-token reach remain unproven pending deployment-supplied evidence.