Hoist Profile rebinding to the outer validation scope

[KimGLee]

Owner Issue

Closes #153

Change

The original #153 reopen loop is already gone after #160: the representative writer now performs zero metadata contract loads and zero compiles. The remaining cost came from nested currency ownership. Each legitimate runtime validation owned a Profile before/after pair, while hub derivation opened a second pair over the same immutable admitted snapshot.

This PR introduces one opaque Profile read scope per outer validation:

• the runtime opens it only after its Profile before-CAS succeeds;
• the scope is bound to the exact repository root, manifest, and authorized view identity;
• nested hub derivation reads the immutable snapshot without reopening the root closure;
• the runtime final Profile CAS still closes the outer phase;
• a standalone hub reader without an outer scope still owns both checks itself;
• K00/17 now forbids carrying the scope across a write, validation return, or transaction phase.

No process cache, state-write shortcut, or receipt-publication shortcut is introduced.

Measured result

Representative update_queue open, same fixture and instrumentation:

• validate_runtime calls: 5 -> 5
• explicit authority CAS calls: 7 -> 7
• metadata load / compile calls: 0 / 0 -> 0 / 0
• Profile root-closure calls: 27 -> 18
• each Profile root input snapshot: 28 -> 19
• repository_file_snapshot calls: 1,590 -> 1,086 (-31.7%)
• os.listdir calls: 646 -> 565
• median local elapsed: about 0.313s -> 0.248s (about -21%)

The count reduction is deterministic; timing is a five-sample local comparison and is supporting evidence only.

Verification

• 334 Profile, Queue, writer, admission, and module-boundary tests
• existing persistent-drift and A/B/A immutable-snapshot tests
• new exact outer-pair and standalone-reader-pair tests
• make check
• git diff --check