P0 threads-okc: Wire identity predicates into mutation intake and deadline replay

[BunsDev]

Parent harness: #884
Cross-repository epic: OpenCoven/coven-threads#31
Phase-5 blocker: threads-okc

Defect

Accepted/migrated identity invariant declarations are available to the Threads core, but the daemon mutation and delayed-replay paths do not consistently evaluate the authoritative identity predicates. Backup/config presence is not enforcement, and descriptor text is not authority.

Required behavior

At proposal intake and every Gate-4 deadline/recovery replay:

1. load the exact familiar/Ward/weave revision bound to the proposal;
2. deterministically compile or retrieve the supported invariant predicate set;
3. materialize the candidate evidence from current authoritative bytes;
4. evaluate predicates before stage/permit/apply;
5. bind the predicate/evidence digest into the proposal classification and replay hash;
6. reject on unsupported, ambiguous, unavailable, stale, or inconsistent evidence;
7. never substitute an LLM probe or Cave/client descriptor for the predicate result.

Direct and scheduled paths must use the same predicate boundary.

E2E evidence

Add a selectable journey to threads_e2e that:

• creates a synthetic familiar with a supported identity invariant;
• demonstrates the pre-fix daemon accepts or fails to enforce an invalid mutation/replay;
• lands the production wiring;
• proves intake refuses an invariant violation;
• proves a proposal whose identity evidence changes before deadline cannot apply;
• proves restart recovery re-evaluates the same authoritative predicate set;
• asserts protected bytes and audit rows remain coherent.

Lower-level regression

Add focused tests around the exact daemon adapter that converts committed familiar state and materialized diffs into coven-threads-core predicate evidence. Include unsupported declaration, missing source, ambiguous normalization, and stale revision cases.

Acceptance criteria

• Identity predicates run on every protected mutation intake path.
• Identity predicates run on every delayed/restart replay path.
• Predicate/evidence digest participates in committed replay binding.
• Unsupported or unavailable predicate evidence fails closed.
• Descriptor/advisory probe output cannot permit a mutation.
• Pre-fix red and post-fix green daemon E2E evidence is attached.
• No second identity model or daemon-local identity definition is introduced.
• Full Coven tests and pinned Threads canary pass.

Rollback

The wiring may be reverted to the last-known compatible daemon commit only by disabling the affected mutation path fail-closed; rollback must not restore an unvalidated permit/apply path.