Stage and resolve worker dAuth secrets

[aledefra]

Summary

• build exact redacted create, update, and scale-up pipeline metadata before dispatch
• stage complete secret bundles and R1FS authorization metadata transactionally, with conditional commit/rollback and concurrent-update protection
• bind each secret bundle to its exact R1FS CID so interleaved writes fail closed instead of returning mixed generations
• safely migrate legacy unbound bundles by reconstructing only current exact placeholder paths
• use persisted R1FS metadata as scale-up authority and preserve offline persisted target nodes
• replicate secret bundles only to dAuth registry oracles while pipeline metadata also reaches normal peers
• require Core 7.7.318 and its pure CmdAPI builder
• remove secret-bearing environment dictionaries, tokens, and commands from platform logs

Stack / dependencies

• Base: Hide Deeploy mandatory secrets in dAuth #468 (codex/dauth-secret-redaction-storage)
• Also requires Add signed dAuth job secret client ratio1_sdk#179 and Resolve dAuth secrets at worker runtime naeural_core#216
• Core 7.7.318 must be published before the edge Docker images can build

Verification

• modern Deeploy discovery: 215 passed
• focused dAuth/staging/update/logging suite: 76 passed
• final dAuth/routing/logging subset: 18 passed
• git diff --check

Full container-app discovery still has three documented local-environment failures unrelated to this change: missing nested Core diskapi.py, macOS /tmp canonicalization, and a root-ownership path assertion. The changed platform-log test passes.