Make transition receipts canonical committed facts

[bigboateng]

Summary

• make TransitionReceipt a success-only, kernel-owned fact for one committed transition
• bind exact program, transition, N-to-N+1 state revision, admitted authority, committed effects, and satisfied verification
• atomically commit the complete fact in the existing transaction journal before passive projections
• replay idempotency from canonical committed facts and keep refusal, rollback, and recovery records non-successful

Control law

A successful receipt can exist only after effects and resulting state are verified and the complete fact is durably committed. The receipt describes history; it does not grant authority.

Verification

• all 194 Go tests across 10 isolated shards
• race tests for kernel and effects
• all 29 Python repository contract tests
• go vet and build
• release-note validation and diff checks

Boundary

External adapters record the settlement evidence they actually return. Stable remote provider identity remains unsupported where an adapter does not provide one; this change does not fabricate it.