Resolve dAuth secrets at worker runtime

[aledefra]

Summary

• keep ConfigManager, _current_dct_config_streams, disk state, and NetConfig views canonical and redacted
• add a separate BusinessManager runtime snapshot with recursive $EE_* resolution and exact-path dAuth placeholder replacement
• withhold unresolved pipelines from both BusinessManager and CaptureManager, retry with capped backoff, and cache by job/date/plugin hash
• fetch bundles through one tracked Orchestrator request worker with hard deadlines and clean shutdown behavior
• centralize identity-aware persistence barriers across direct saves and command-driven pipeline, instance, and batch updates
• keep config debug diagnostics useful without logging configuration values
• discard in-flight dAuth success and retry results whenever the complete canonical pipeline snapshot changed during the fetch
• expose a pure CmdAPI pipeline builder for pre-dispatch staging
• rebase onto current main, bump Core to 7.7.320, and require SDK 3.5.50

Dependency

• Requires Add signed dAuth job secret client ratio1_sdk#179 and published SDK 3.5.50.

Verification

• focused runtime/admin and adjacent regression suites: 94 passed on Python 3.10 with local SDK 3.5.50
• changed-module python -m compileall: passed on Python 3.10
• runtime version in naeural_core/main/ver.py: 7.7.320; pyproject.toml project version unchanged
• git diff --check: passed
• independent critic review of the three follow-up fixes: no findings
• full business discovery: 282 tests run, 56 unrelated local-environment errors, 1 skipped

The broad BusinessManager discovery gate remains blocked by the same existing local-environment failures (NetMon tests mutating PATH, stale oracle fakes, missing structured-training modules, and local torch backend mismatch); all new focused tests pass.

Deferred risk

• dAuth secret bundles still bind PLUGINS and INSTANCES positionally. Generation and identity binding is intentionally deferred from this update.