Bind declarative state effects to admission and target law

[bigboateng]

Follow-up to #208. Remote review found four control-boundary gaps in the declarative state-effect implementation.

This change:

• derives product mutation capability from owned facets instead of effect-name prefixes;
• requires an assignment to satisfy every target condition for its facet;
• reconstructs recovery write authority from the admission-bound capability identity instead of mutable journal data; and
• preserves the current schema-8 journal shape across runtime activation while treating its recorded facet envelope as evidence only.

Regression coverage includes arbitrary product effects, conjunctive target conditions, admission-bound recovery, schema-8 pending update recovery, and committed-journal idempotent replay.

Verified locally with the full Go suite under the race detector, repository contract tests, release-note validation, vet, build, and diff checks.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.99

The journal downgrade breaks the immediate base-to-head migration boundary and can strand an update after runtime activation or block repositories with existing committed facts. Model-level verification is recommended before merge: verify every interruption point around runtime activation remains recoverable across all supported journal versions.

[github-actions]

Codex automated review

Verdict: patch is correct
Confidence: 0.88

No actionable patch-introduced defect was established. Resolver targets, capability classification, facet ownership, and recovery write envelopes remain aligned. Model-level verification is recommended for cross-version schema-8 recovery reachability, especially interrupted installation reconciliation.