Strands: register_strand asserts lineage without fork evidence #901

Part of #891 (Paper VII conformance remediation).

Problem

WorldlineRuntime::register_strand is public and accepts a strand relation (child worldline, fork basis) with no evidence that the child's history is actually the fork basis's prefix. fork_strand creates that evidence: it copies the prefix and records what the copied ticks decided. A registered-only relation is an unproven claim about a causal past.

The review of PR #890 found three ways such claims let an occurrence already present in the claimed past be admitted again:

• a registered strand with no recorded prefix;
• a strand forked from a registered-only strand;
• a registered-only intermediate that itself holds the binding.

#890 fails closed on each (AdmissionCoverageUnestablished), validating the whole lineage before trusting any binding. Paper VII Def. 2.3, however, defines a strand by its fork anchor, and the API still lets callers assert one without it.

Decision needed (owner)

• A. Make register_strand crate-private, so only fork_strand and recovery create relations.
• B. Keep it public, but require and verify prefix evidence (the child's provenance prefix equals the source's up to the fork tick).
• C. Keep it as is, relying on the fail-closed checks.

Recommendation: A, if no external caller needs it; otherwise B. C leaves lineage claims that admission must keep distrusting.

Acceptance

Whichever option is chosen, with a witness that an unproven relation cannot be created, or cannot be relied on.