fix: reconcile live authority sources with current host Core #46

The current SDK live-authority source does not compile when composed with the Core revision selected by current host main. This blocks real-host conformance of a generated-contract refresh even though the SDK's standalone build/test/race suites pass on its own older Core floor.

Exact selections:

• SDK main/tag v0.1.3: 14fe024ef26097cec9287ca4ce064b97105412f6, Core v0.19.1.
• Host base main/tag v0.0.103: 2cb00737ed56c79c823bc82f4055681a51919e7c.
• Exercised host candidate #1195: f9321b94d91eb91252e7611d571d5bf99cca370a; it preserves the base's Core v0.19.6-0.20261018171306-0a8d16c5e32d selection.
• Candidate SDK generation: exact host candidate, unchanged SDK Buf 1.73.0 recipe/plugins; complete generated tree retained. The SDK's moduleauthority/verifier_sources.go is unchanged from main.

Supported reproduction, from the candidate SDK checkout whose SOURCE.txt records that host:

conformance/hostgateway/run.sh <clean-exact-host-checkout> -race

Observed before any conformance test runs:

# github.com/codefly-dev/saas-sdk-go/moduleauthority
moduleauthority/verifier_sources.go:362:26: undefined: corework.ErrNoApprovedBuild

The host Core's workcontext.SealSource no longer asks for an approved build per principal. The unchanged SDK still implements the old ApprovedBuild branch and refers to the removed sentinel; its tests also refer to that sentinel. This is not a request to create a new verifier or weaken the conformance version guards.

Existing draft #45 (b7169d3c40957656f89dc4852a42379cb5f7d3a8) owns Core/host adoption and uncached organization minting. It currently selects Core v0.19.4 and host v0.0.97, diverges from main by two commits on each side and reports merge conflicts. Reuse that owner work and reconcile the current live-authority contract; do not duplicate its lifecycle API in a source-read client PR.

Acceptance: reconciled owner selection compiles, preserves the current authority semantics and passes the unchanged real-host conformance harness, standalone build/vet/test/race, API-boundary gate and exact generation check. This report does not qualify live Accounts admission or a deployed composition.