fix: verify Codex runtime submissions before mutation

[Stahl-G]

Summary

• reconstruct the complete expected RoleTaskEnvelope from the verified Store prefix and require exact strict-model equality in both advisory validation and acceptance
• bind source proposal sibling bytes and hashes through the same verifier
• validate, deduplicate, size-bound, and stage human/provider source packs before Invocation or workspace scratch mutation
• resolve exact replay before mutable input reads/provider calls and recover a committed Invocation through the same deterministic stage/request identity

Root cause and invariant

Runtime ingress previously used partial validators and could read large source packs or create Invocation/scratch state before the complete submission was bounded and verified. This change makes one shared non-authoritative admission kernel the precondition for mutation while SQLite receipts remain the only business authority. Host-private staging is inert and reverified; it never decides legality.

State x Path coverage

• every envelope field, including task_instructions, is reconstructed from the invocation-start receipt and exact pre-start Store snapshot
• source content/raw sibling mutation fails both validation and acceptance; post-validation edits are rechecked
• 257 provider results, overlapping cached roots, and conflicting duplicate identities fail with zero Invocation/Store/scratch writes
• 256 valid results commit through one Invocation/UoW/receipt; identical duplicates collapse deterministically
• fstat oversize and bytes that grow past observed size stop at bounded reads with no authoritative mutation
• committed human/provider replay performs no second file read/provider call
• active Invocation plus valid stage resumes the same identity; missing or malformed stage records one fixed failure; commit-outcome-unknown replays the same request

Validation

• editable Unit A tests: 40 passed normal
• editable Unit A tests: 40 passed under python -O
• immutable adjacent runtime/init tests: 167 passed
• non-editable wheel parity: 1 passed
• Ruff check/format and git diff --check: passed
• pre-push public-safety and terminology checks: passed

Scope / non-goals

Six files only under the frozen Unit A allowlist. No SQL or migration changes, CLI/init-web changes, runtime assets, docs, RUN-UX, LAJ/QP, legacy compatibility, or runtime install --runtime all follow-up. README surfaces do not change.

Candidate checkpoint: a4cf35e68ea823a2ffa8914144b8150f63d41b88 on base bd08ac92f5de777ecec4c0127d9efa4309fc3b01. During the Human Build Week freeze this PR remains Draft and must not merge.