fix(benchmark): restore governed live Vault density replay

[tcconnally]

Summary

• Adds an owned EphemeralAdmissionFixture for governed live Vault density replay.
• Binds the per-run HMAC source attestation to the MCP client identity and minimal enforce-mode authority.
• Runs the synthetic, sanitized-corpus, and probe replay paths through public Vault MCP APIs.
• Verifies recalled category/key addresses and preserves the unauthenticated proposal negative contract.
• Adds an opt-in CI job pinned to Perseus Vault #1131's supported fixture revision.

Verification

• Fresh Vault 2.23 lean binary: cargo build --locked --no-default-features
• Targeted replay suite with the live binary: 18 passed
• Targeted suite without a binary: 15 passed, 3 skipped
• Live synthetic density gate: 3 cases, network_calls=0, production resumption/load-bearing/decoder 1.0000, PASS
• Live six-probe replay: hit@5=1.0000, MRR=1.0000
• Ruff, Python compilation, YAML parsing, and build-artifact check passed
• Full local suite excluding the environment-dependent disconnected cgroup harness: 2761 passed, 8 skipped

The sanitized corpus lane uses Vault's documented operator-only admission-lint override inside its owned child process only; normal clients and the separate negative contract remain governed.

Closes #999