Pin NyxID registry v8 and harden postcondition binding

[eanz17]

Problem

PR #3496 cannot be merged cleanly into feature/integrate, and its dormant NyxID v8 path did not bind every action postcondition to the exact typed verification input. Rolling upgrades could therefore encounter legacy generation-1 results whose completion, redispatch, late arrival, or replay semantics were not deterministic enough for actor-owned recovery.

Solution

• Retain the NyxID v8 tolerant-consumer pin and dormant service.reauthorize producer/mapper path without advertising or mounting the action.
• Add typed verification_input_binding and actor-owned contract-upgrade outcomes for migration, generation-2 redispatch, late-result fencing, and fail-closed termination.
• Bind completed browser evidence to the exact action request, source tool, admission/report, typed postcondition input digest, operation generation, and continuation.
• Recompute every migration/recovery event from current actor state during replay and byte-compare the committed snapshot; reject unrelated keys and tampered state.
• ACK/fence legacy digestless generation-1 results without promoting them to evidence; redispatch only when re-verification is required.
• Activate projection observation for the new committed upgrade event and pin all six new contract-bearing source files in the NyxID conformance manifest.

The action remains dormant. Authenticated NyxID v8 canary evidence and the advertising follow-up remain separate.

Impact

NyxID chat actor state/proto, browser-action recovery, task lifecycle, continuation correlation, projection activation, AI tests, and the NyxID conformance source manifest.

Verification

• dotnet test test/Aevatar.AI.Tests/Aevatar.AI.Tests.csproj --no-restore --nologo --filter '<NyxID focused filter>' - 148 passed, 0 failed
• dotnet test test/Aevatar.AI.Tests/Aevatar.AI.Tests.csproj --no-restore --nologo --no-build - 3428 passed, 0 failed
• bash tools/ci/nyxid_conformance_guard.sh - passed
• bash tools/ci/test_stability_guards.sh - passed
• bash tools/ci/architecture_guards.sh - passed; Architecture.Tests 19/19
• bash tools/docs/lint.sh - 92 files, 0 errors
• git diff --check - passed

Refs #3312.
Supersedes #3496.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.38%. Comparing base (6781f4f) to head (50391ab).
⚠️ Report is 21 commits behind head on feature/integrate.

@@                  Coverage Diff                  @@
##           feature/integrate    #3505      +/-   ##
=====================================================
- Coverage              83.39%   83.38%   -0.01%     
=====================================================
  Files                   1659     1661       +2     
  Lines                 186215   187009     +794     
  Branches               22432    22506      +74     
=====================================================
+ Hits                  155294   155946     +652     
- Misses                 20517    20627     +110     
- Partials               10404    10436      +32     

Flag	Coverage Δ
ci	83.38% <100.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...stractions/INyxIdChatConversationStateQueryPort.cs	84.56% <100.00%> (+0.26%)	⬆️
...tors/NyxIdChatConversationCurrentStateProjector.cs	77.67% <100.00%> (+0.48%)	⬆️

... and 16 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.