Compose durable Intelligence build hosts - #172

What changed

• recover one exact ACTIVE Builder bootstrap from durable product-scoped records
• resolve the exact canonical activation and installed inert Domain Pack
• compose invocation-scoped recorded-source and prepared-derivation ports over the same durable store
• add a narrow Core-owned subject-binding seam so domain executors never forge activation coordinates
• fail closed on malformed or ambiguous correlated material; expose neither port when no exact bootstrap exists

Verification

• focused composition and subject binding: 24 passed
• public, naked-kernel, exact-eleven, installed-Pack, executor, package, and schema boundaries: 68 passed
• disposable Surreal restart/reopen: 1 passed; both ports reconstructed after restart with the same product fence and exact activation binding
• Ruff and diff checks: passed

Boundary

No Brief or cognition composition, UI, domain logic, MCP surface, owner bootstrap, token scope, grant, authority class, provider, merge, release, or publication changes.