Host follow-ups from the independent review of #1146: durable principal/publisher ownership, receipt serialisation, nested namespace prefixes, local mechanisms #1147

From the independent security review of #1146 (verdict MERGE). These bite on a host that pins more than one ownership domain or runs more than one accounts replica; obin-staging pins one domain today.

1. Principal/publisher ownership is not durable (module_manifest_host_rules.go:44,55-65, solution_delivery.go:216-228): a withdrawal releases the principal, so another pinned domain can claim it (and the envelope grant, copied whole) before the owner's replacement binding arrives; a receipt accepted then withheld blocks the owner forever. Record principal→domain and publisher→domain at first apply, never released by a withdrawal; judge receipts against applied (or not-withheld) holders.
2. Receipt is not serialised (solution_delivery.go:184-251): concurrent first claimants both get 200; the pass's tie-break is binding id, not delivery order (postgres_solution_delivery.go:87, solution_host_bindings.go:529) against SOLUTION_REGISTRATION.md:401; two replicas can apply conflicting claims (fail-closed but stuck). An advisory lock around the receipt checks and the apply.
3. Nested namespace prefix (core#813): alias eu-wiki under prefix p- is cell p-eu-'s wiki namespace; the TokenReview audience accounts is shared across cells in one cluster. The host should refuse a namespace that belongs to another cell (or core's rule should carry the prefix).
4. Native endpoint addresses may use any loopback port (module_manifest_host_rules.go:84-88) — an alias can point at accounts' own internal listener in a native run.
5. Native fact cache keyed by module+instance, never pruned (native_workload_identity.go:101-115) — spurious UID-mismatch refusal under rotation (fails closed).
6. The old SOLUTION_HOST_LOCAL_CLUSTER stand-in (kubernetes_token_review.go:156,224) coexists with the native attester; if cli#1014 replaces it, delete it (legacy means delete).

🤖 Generated with Claude Code