Add governed prepared Shift/Signal bridge

[eamirian]

What changed

• add an exact PREPARED derivation request selecting one baseline Entity Snapshot, one current Entity Snapshot, one declared detector, and one evaluation time
• add a narrow Builder host port and Core service for Entity → Shift → Signal → attention
• dispatch only the existing numeric-delta and categorical-transition Pack interpreters
• extend the PREPARED ledger with derived-only admission that persists exactly the new Shift, Signal, and attention receipt in one transaction
• require the exact current committed activation plus one exact current build-authority grant precondition
• reload selected Entities and resolve their existing lineage from the ledger without duplicating Observation or Entity records

Governance and replay

The service accepts only an authorized Intelligence build whose reviewed effects include activate_watch. It re-resolves the original build authority at use time and rejects a changed grant, stale activation, crossed product/activation, wrong detector/reference, or unavailable selection. Historical state may predate activation only when projection and detection occurred after the exact activation.

Material derivations are exact-replayable across a fresh service. A no-material result writes nothing. Any transactional failure writes no partial Shift, Signal, or attention record.

Verification

• focused bridge and PREPARED ledger: 11 passed
• Builder/source/entity/ledger/detection/routing/projection/public-boundary matrix: 203 passed, 2 skipped
• full supported Core gate: 7,985 passed, 50 skipped, 262 deselected
• Ruff check and format: passed
• clean diff check: passed

Explicit boundaries

This adds no provider invocation, Brief synthesis, UI, domain-pack implementation, authority class/grant/scope, MCP tool, or public tool-surface expansion.