Make runtime authority membership explicit

[KimGLee]

Summary

Thanks to the earlier closure review for exposing that runtime authority membership was implicit. A full recheck also corrected the initial diagnosis: metadata execution authority was already byte-covered by the Profile-load CAS, so adding another filesystem CAS would have duplicated work and worsened #153.

This change fixes the systemic problem instead:

• defines a closed machine-readable registry of primary and derived runtime authorities;
• registers active Standards and Profile-load as primary CAS authorities;
• registers the compiled metadata execution contract as a Profile-load-covered derived authority;
• retains and reuses the exact compiled metadata object produced by the successful Profile admission;
• binds the metadata contract fingerprint into writer-lock evidence;
• removes redundant runtime reopen checks where the admitted object is available;
• corrects K00/17 and related documentation from the stale three-input description to the actual nine fixed roots plus the dynamically closed implementation set;
• adds identity, closedness, drift, and no-reopen regression tests.

No process-lifetime cache and no third authority graph are introduced. Standalone tools without an admitted runtime keep their existing explicit loader path.

Verification

• 409 focused writer/Profile tests passed during implementation
• 245 final authority/Profile/module-boundary tests passed
• make check
• git diff --check

Closes #160
Related to #153