Add atomic HA credential authority

[rblake2320]

Scope

Adds the missing bounded HA TumblerMapStore source authority needed by the Enterprise independent-state acceptance lane.

• every successful lifecycle/counter mutation updates the secret-bearing source map and appends one signed, hash-linked TSK record in the same SERIALIZABLE transaction
• the source lease and runtime authority posture are rechecked at the transactor pre-commit boundary
• the runtime role cannot inherit governed table/routine ownership, DDL, direct DML, secret-table reads, or helper execution; post-mint grant/key drift fails closed on every mutation
• a fresh challenge proves the active HMAC mutation key without disclosure; transaction-bound tickets use DB-clock expiry, single-use nonces, indexed pruning, serialized insertion, and a hard 10,000-row capacity
• signed secret digests bind the actual secret-bearing source effects while independent B verifies secret-digest continuity, exact stream/header binding, operation digest, signed head, fence, order, head chain, revision/lifecycle continuity, gaps, replay, and tampering
• HOTP counter updates match the core lifecycle semantics, including zero request caps, warning transition, final-counter expiry, invalid-input refusal, and no mutation on rejected use
• replicated state is exact, secret-free public staging and cannot authenticate until governed secret reprovisioning
• live full-catalog PG16 attestation and unforgeable transactor/schema/role/key-bound capabilities fail closed on drift

This reuses the merged TSK HA protocol. It does not add a second replication protocol and does not make a new HA or promoted-authentication claim.

Evidence

• npm test
• npx vitest run packages/server/tests/ha-outbox-contract.test.ts (13)
• npm run test:hotp-outbox -w packages/server (25)
• npm run test:pg-transactor -w packages/server (27)
• npm run test:http-outbox -w packages/server (24)
• npm run test:credential-authority against two independent PostgreSQL 16 instances (48 checks, 9 ordered records, zero duplicate effects, zero stale writes, zero secret-bearing replica records)
• npm run test:pack (4/4 package boundary)
• npm run typecheck
• npm run build

Boundary

A separate provisioning identity installs the DDL, ticket keys, and runtime grants. The application runtime receives only a bounded signer; its database identity has no DDL, authority-table DML, inherited owner authority, or ticket-key read privilege. Public replica state is staging evidence, not an authentication credential. Signed cutover activation, target-only secret reprovisioning, the full multi-site topology/fault/failback matrix, and the production claim remain gated by selfconnect-enterprise issue #28.