Admit exact recorded Builder sources

[eamirian]

Problem and scope

The Intelligence Builder can authorize source groups, but it previously had no exact reviewed material coordinates or Core-owned recorded-replay admission path. This change adds only the domain-neutral request contract, admission service, public exports, and focused tests.

Explicit exclusions: live network acquisition, freshness claims, mutable source catalogs, domain repository changes, MCP expansion, authority widening, merge, release, or publication.

Product boundary and compatibility

• Binds exact reviewed recorded_source_refs (source_group_id, material_id, material_digest) into the build request and authority subject digest.
• Admits exact recorded material as durable acquisition receipts plus canonical PREPARED Observations through the committed activation mapping.
• Fails closed on missing, extra, substituted, stale, or replay-mismatched material.
• Uses the activation approval and compatibility path now merged on Core main.
• Recorded replay only: no network capture is performed and freshness is explicitly not verified.

Base and evidence

• Exact merged Core base: 84ab7d04f8dd3185175cb86a83ca2f7bb5d7bcb3
• Exact change head: 7981ef72a89103e07a68a3e9c42b88f70169fea3
• Focused recorded-source and Builder API gate after restack: 11 passed
• Ruff check passed
• git diff --check passed
• Prior cumulative Builder/activation/recorded-source gate before topology reconciliation: 123 passed, 2 skipped

Risk and rollback

The service is fail-closed and writes only after exact batch, authority, activation, and append-precondition validation. Rollback is the single commit 7981ef72a89103e07a68a3e9c42b88f70169fea3; no schema migration, package publication, or external action is included.

Checklist

• I used no private data, credentials, proprietary fixtures, or private-extension code.
• I updated public exports for changed public behavior and did not overstate maturity.
• I ran focused checks, relevant conformance checks, Ruff for changed Python, and git diff --check.
• If roadmap-related, I linked or updated the public issue/Project item.
• Security-sensitive details were not introduced.