feat(runtime): recover retained execution and authenticate coordination

[drewstone]

Interrupted provider runs could leave live work detached from its manager or lose accepted results during cleanup.
Runtime now restores retained root, nested manager, and leaf invocations from durable evidence before managers admit new work.
Recovery preserves original identities, reservations, worker capacity, finalizers, and unresolved keys without dispatching replacements.

• Require authenticated, bounded remote coordination requests and advertised provider MCP attachment support.
  Stable signing keys preserve access across local restarts within the original credential lifetime; credentials are not renewed automatically.
  The legacy Sandbox mapper refuses attachments unless the consumer supplies an explicit mapper.
• Reconcile cumulative usage and duplicate receipts without double counting, and journal manager inference before terminal settlement.
• Validate admission and result ordering, preserve durable blob publication, and give memory and file stores the same detached JSON representation.
• Cover canonical router output token limits in materialization receipts.
• Consolidate GEPA and SkillOpt Runtime controls and remove obsolete analyst conversion and certified-profile composition APIs.
  This integrates and supersedes cleanup PR refactor(runtime): consolidate optimizers and remove unused delivery paths #1135; that cleanup is not a separate merged dependency.

Release versions: Runtime 0.200.0 and Bench 0.9.2, with published Interface 2.4.0 and Sandbox 0.36.4.

Validation on 6862be3f (CI run):

• All four CI jobs passed: Runtime CI, exact packed cohort, benchmark consumer, and official GEPA/SkillOpt integration.
• Full suite: 3,578 passed, 6 skipped across 282 files.
• Source and example typechecks, lint, API surface, fixtures, model execution boundary, static imports, skills, build, generated documentation, and release version checks passed.
• Packed checks verify strict consumer types, imports, dependency deduplication, and a Cloudflare Worker execution.

Local verification also passed on Node 24 with serialized checks and a 2 GiB process-group ceiling.
Live Tangle verification remains pending; local recovery tests do not establish deployed provider conformance or distributed fencing.