Authorize CK-07R1 prelaunch failure recovery

[douglasmonsky]

Summary

• add versioned CK-07R1 prelaunch-failure recovery authority, schema, verifier, and roadmap bindings
• preserve the terminal v1 prelaunch-failed ledger while authorizing only a first successful child launch through new v2 paths
• reconcile historical CK-08 consumers with the exact corrected recovery cohort without changing accepted authority bytes
• enforce exact committed authority and all-or-none combined candidate deltas

Exact recovery cohort

• preparation: 66c015de949a6c380bd49964cb6c48c30dee64ecb14074b480837c44024328ea
• benchmark: 37cb7330494675b2211f31ab419b4105d23f5c71856a546f735304883f25ba8e
• lifecycle test: 47659f999ae765d6f09472eb7db67814c60ec8bd0fccbd258fda1654e22e2854
• preserved v1 ledger: 5c2b42eca6a3e54cf4163226bc55f3c75aa35112c4ed0342c11f4e39cb9922be

Validation

• authority consumers: 175 passed
• exact combined authority/candidate suite: 458 passed
• just vp, just v, just vc: green; 1481 passed, 1 skipped
• worker focused/broader/privacy: 92 / 290 / 12 passed
• sole reviewer correction pass: clean
• Python 3.14 local; Python 3.10 delegated to hosted CI

No CK-07 qualification launch, token consumption, v2 output/ledger/stdout/stderr/receipt creation, live data use, or downstream dispatch occurred.