Make C10 recovery qualification deterministic

[KeyffMS]

Summary

• route only C10 around the model-authored generic fixture planner
• create the active PlanAnvil generation run in the outer harness
• create and validate the real product generation checkpoint before live Codex probes
• verify SessionStart recovery context without tools
• isolate PostCompact from SessionStart, force genuine automatic compaction only in the disposable qualification fixture, and verify recovery context independently
• keep the opaque recovery proof out of persisted evidence
• reuse the runner's live Codex auth/persisted-trust runtime

This does not change PlanAnvil product hook semantics, sandbox/approval policy, or the release gate.