feat: support governed same-stream return activation

[rblake2320]

Scope

Bounded protocol amendment for governed same-stream return activation (A -> B -> A). This does not expand the existing HA/uptime claim and does not update any downstream pin.

Change

• replaces the single immutable tsk_ha_source_activation record with a signed current head plus append-only activation history
• accepts only strictly advancing activation epochs; any skipped control epoch must be a verified, terminal ABORTED cutover with no source activation
• requires a returning target's bounded strict snapshot of its full signed, contiguous lease chain through a terminal revoke, rooted at its last control activation
• adds activateFinalizedReceiverAsSource, an owned SERIALIZABLE target authority that rebuilds persisted finalized staging, re-verifies both export signatures and the complete 1..N ledger, then atomically installs ledger rows, fence, checkpoint, and activation lease
• removes all manual multi-transaction target import from the A -> B -> A drill; a pre-COMMIT crash proves all-or-none and exact retries are idempotent
• bumps the control schema to v2 with a separate privileged offline v1 -> v2 migration that exact-attests the v1 catalog/stamp, verifies legacy signed ACTIVE + source-grant evidence, backfills signed activation history/head, exact-attests v2, and stamps v2 in one transaction
• uses separate B-receipt and source-lease public-key resolvers; no verifier needs signing material

Evidence

• npm run build - green
• npm run typecheck - green
• npm test - green
• npm run test:ha-control-migration - 2/2 real PostgreSQL 16 (success + invalid-legacy rollback)
• npm run test:ha-control-continuity -w packages/server - 6/6
• npm run test:ha-fencing - 20/20 real PostgreSQL 16 + Redis
• npm run test:control-cutover - 10/10 real A/B/control PostgreSQL 16 + Redis
• npm run test:b-activation - 5/5 real A/B/control PostgreSQL 16 + Redis, including an intervening consumed ABORTED epoch, atomic A -> B and B -> A import, returned A originates N+2, old B denied, strict-chain rejection, activation rollback/tamper rejection, and byte-identical retry
• npm run test:pack - 4/4 package boundary plus dry packs
• npm audit --audit-level=high - 0 vulnerabilities

The local drill used three independently initialized PostgreSQL 16 clusters. Hosted CI's digest-pinned PostgreSQL 16 Alpine + Redis matrix is authoritative. PR stays draft and no downstream pin moves until independent review is CLEAN.