Keep cold authority boot on the verified path

[JROChub]

What changed

• extends the outer boot recovery bound so a valid cold authority fetch is not preempted
• moves service-worker refresh off the provenance/WASM critical path
• gives each provenance and reconstruction module phase a realistic cold-start bound
• adds a browser regression that delays Keyxym WASM for nine seconds and still requires authoritative mode
• keeps the explicit iPhone recovery path testable without waiting for the full production watchdog
• makes the live deployment gate require the corrected watchdog marker

Root cause

The HTML recovery watchdog and each authority phase both used an eight-second bound, while service-worker refresh was awaited before provenance verification. A cold browser/edge fetch could therefore be switched into the visual-preview fallback while the correct verified authority was still loading. That made the live Theater appear to ignore the already-deployed retained reconstruction.

Impact

Cold first visits remain on the verified Keyxym World Cell path. True module failures still surface the visible basic-camera recovery after a bounded delay.

Validation

• 31/31 contract tests
• production TypeScript/Vite build
• Chromium cold boot with a deliberate nine-second Keyxym WASM delay
• 2/2 iPhone WebKit authority and recovery tests