Bootstrap canonical Builder activation

[eamirian]

Summary

• give new canonical v1alpha1 activations and Builder v1alpha2 plans distinct versioned governed-state namespaces while preserving the old shared namespace as immutable read-only compatibility
• persist exact Builder activation-plan and activation-receipt artifacts, then bootstrap only from the current Core-admitted plan through a separately resolved exact-spec approval
• derive runtime head preconditions from the committed receipt, resolve the exact compiled Pack through a read-only resolver dependency, and fail closed on stale, mismatched, revoked, non-current, or non-initial material
• make exact replay idempotent without minting approval, widening authority, or changing MCP/domain surfaces

Verification

• Ruff: green
• focused activation / Builder / recorded-source / boundary: 53 passed, 1 skipped
• live + prepared runtime / Brief / source gates: 111 passed, 2 skipped
• full supported suite: 7762 passed, 245 skipped, 262 deselected
• git diff --check: green

Environment limitations

The full supported run had six sandbox-only failures caused by denied loopback socket operations: two disposable Surreal port binds, two Canvas localhost binds, the egress closed-port connection check, and the startup closed-port bind. These are unchanged environment restrictions rather than product failures.

Boundaries

This PR does not implement owner UI approval, change tokens or authority classes, add domain vocabulary, expand MCP, merge, release, or publish. Exact compiled Pack loading remains a host/resolver dependency.