fix(policy): reconcile Daily recovery ownership

[mattebad]

Scope

REC-D01 only, from verified origin/main d150b78.

• Reconcile all 31 unique Daily catalog keys to their exact recovery owners while retaining historical owners, states, deferrals, and missing proof.
• Encode Ultimate Join versus Main Clear/Campaign, Nova versus Personal Might, BuyBox versus ResourceBuildingBoost, Resource Item evidence prerequisites, and Gather Food exclusion.
• Require current positive training/march postconditions. Supply Depot is Free-only and stops when Free disappears; permission does not imply Daily completion.
• Machine-check no-premium/paid/refill/unknown-cost controls and non-authorizing static policy. Negative tests repair the authority digest before validation, so checksum rejection cannot mask a missing policy guard.
• Advance static policy to flow-delivery-product-authority-v2-r13 and migrate all 24 current contract bindings. Existing flow enablement, registrations, queue eligibility, runtime state, and retained evidence are unchanged.

Verification (Python 3.12, offline)

• python -m unittest tests.test_daily_quest_planning tests.test_catalog_and_pnsctl tests.test_product_authority tests.test_gameplay_flow_contracts: 110 passed.
• python scripts/check.py: 296 passed (selected static suite, not comprehensive).
• Existing affected CI unittest selection: 117 passed.
• python -m compileall -q automation_service safe_action_core scripts tasks tools: passed.
• Static API smoke: 31 unique recovery owners; all historical owner/state fields retained; no dispatch authority; digest-correct premium, paid, refill, and unknown-cost mutations rejected.
• Staged and committed PR diff whitespace checks passed.
• Windows/Linux CI includes the focused modules; jsonschema is pinned for existing contract validation.

No device/runtime/native acceptance is claimed. No production state or evidence was modified. This PR must not be merged by the orchestrator.