fix(track-a): reconcile promoted canonical bootstrap admission

[blakinio]

Track A canonical bootstrap admission reconciliation

Entry task: OTC-20260816-track-a-canonical-runtime-e2e.
Base: exact trusted main@fa5b66b697d42c60515c5de48ea5e30135eadd0e after #429/#430 promoted and archived the minimal Xvfb DRI-provider repair.
Execution: GitHub-hosted only. This PR has runtime_access: none, mutation_authorized:false, and performs no Synology/canonical/client action.

Why this is needed

Trusted main already contains the reviewed canonical bootstrap/rebind/Gate-B implementation from #371 (d16091ca29ff7c9330115e9ce0fdbfb41646e0dc), lifecycle-closed by #375 (259e418b2c526f93bd697f07c42b73b1fd40a914). The current deterministic admission validator still contains an unconditional pre-#371 rule that rejects every canonical_bootstrap task with mutation_authorized:true, which caused v7 governance to fail with bootstrap is not currently implemented/authorized.

This PR reconciles the validator with the already-promoted implementation. It does not weaken the bootstrap transaction or allow this unmerged PR to authorize itself.

Reconciled boundary

A future freshly admitted canonical_bootstrap checkpoint may authorize exactly one invocation of the reviewed transaction only when it explicitly records: registration ABSENT, pre-run lease generation UNKNOWN, Gate A and target uniqueness REQUIRED_NOT_PROVEN/UNKNOWN for the transaction to prove under the canonical flock, bootstrap: PASS, bootstrap_attempt_limit: 1, a concrete owner authorization source, and credentials/login/gameplay all false.

The validator independently verifies that the promoted #371 transition implementation and #375 terminal archive exist on the trusted base. The transaction itself must still acquire/validate current lease authority under the canonical flock, re-prove authoritative registration absence plus complete official-client candidate/session uniqueness immediately before launch, atomically register the exact fenced client, and pass same-generation Gate B. Any failure remains fail-closed.

Validation

A temporary ubuntu-latest validator exercises the positive one-attempt case plus negative cases for unknown registration, stale Gate-A/uniqueness preclaims, multiple attempts, missing authorization source, credentials/login/gameplay enablement, and non-PASS bootstrap. Existing fail-closed bootstrap checkpoints remain valid.

After this PR is merged to trusted main, the same canonical-runtime task must be freshly re-admitted from that new main before any physical action. No physical workflow is part of this PR.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[blakinio]

Coordinator disposition: CLOSED_SUPERSEDED_BY_436 / accepted reconciliation preserved. Source head cb4a9283cd8c2ad8bcbb584f631619a9255c2ce0 passed independent transactional-admission validator 31970995035 / job 95223324421, exact-head Track A governance 31971035068, pre-ready CI / Required 95223592746, ready-state CI / Required 95223786044, and had zero review threads. Merge was correctly refused only because strict required-status policy observed main advance through independent #432/#434 while the ready-state generation was running. GitHub's conflict-free current merge tree was replayed linearly onto main@0bdc82583417616ccd4a2ef52a9005bcc18eb660 as replacement #436, preserving #432/#434 and the audited validator code. This source PR must not be merged from stale history.