fix(acceptance): fence authority by Goal instance

[Duang777]

Summary

• add a canonical active/retiring lifecycle record for Goal acceptance
• bind acceptance state and all new mutations to an exact goal_ref
• re-project historical operation receipts against the current canonical head so Goal A history cannot authorize Goal B
• preserve legacy alias-only behavior until an exact source owner binds the existing instance

This is the A1 dependency for the source-session recreation integration tracked in #5206. It does not claim completion of the broader RFC.

Validation

• node --no-warnings --experimental-sqlite --experimental-strip-types --test tests/control_plane_ts/goal_acceptance_authority.test.ts tests/control_plane_ts/effect_runtime_handlers.test.ts (58 passed, 17 PostgreSQL/environment skips)
• npm run typecheck:control-plane
• scripts/loopx canary premerge --from-git-diff --git-diff-base upstream/main --tier standard (13/13 selected checks passed)
• full control-plane run: 4,245 passed, 33 skipped; the only failure is the existing content_digest_single_owner finding in unchanged action_review_plan.ts:114

Runtime boundary

• File and SQLite provider lifecycle/CAS/replay paths pass locally.
• PostgreSQL parity rows are present but require LOOPX_TEST_POSTGRES_URL; no local PostgreSQL daemon was available.
• No provider promotion or self-merge is performed.