refactor(control-plane): share typed settlement receipt-chain driver

[huangruiteng]

What

Extracts a core-owned loopx/control_plane/settlement_driver.py owning the typed settlement receipt-chain semantics that the quota adapter and the isolated Turn adapter each re-implemented:

• settlement_identity_from_plan — resolve the complete typed identity/effect id from a transaction plan, failing closed on missing/contradictory identity;
• require_matching_effect_id — the IDENTITY_MISMATCH cross-check (same rule as fix(turn): fail closed on key/owner-mismatched settlement replay (GH-C83 M7.1 parity) #3193), with None provenance as the opt-in seam;
• seed_committed_steps — ordered committed-receipt seeding from durable step payloads, with per-step missing-failure kinds and exact preserved messages;
• commit_step_effect — run one step effect, validate the committed payload, checkpoint phases, and record the receipt;
• settlement_receipt / effect_ids_match / is_committed_payload — shared factories/predicates.

The Turn adapter (turn_driver/settlement.py) now delegates identity resolution, seeding, and step effects to the driver while keeping its public execute_turn_driver_settlement signature; the quota adapter (quota/settlement.py) reuses the shared receipt factory and effect-id predicate. Domain policy stays outside the driver: scheduler apply/ACK, Todo lifecycle reducers, spend accounting, and vision/replan qualification remain in their bounded contexts.

Validation

• tests/control_plane/test_settlement_driver.py (new, 15 tests) pins the shared contract: identity resolution, mismatch cross-check, ordered seeding, validator vs effect mode, failure-kind mapping.
• Existing suites unchanged and green at exact head: turn transaction/executor/driver, quota settlement/should-run parity/CLI projection/slot accounting, adapter conformance, incident replay, fault replay matrix, state-refresh projections — 214 focused tests pass locally.
• Ruff within the repo pin (0.15.4) and py_compile pass on all changed files.
• No behavior change: the diff is a behavior-preserving extraction; the committed-effect cross-check activates only when a caller supplies provenance (already wired by fix(turn): fail closed on key/owner-mismatched settlement replay (GH-C83 M7.1 parity) #3193's executor change).