fix(governance): bind simulation proposal versions to workday custody

[adrianwebb]

Outcome

Keep simulation proposal handoff in authoritative local workday custody.

Work authority

• Work item / Issue: Closes Bind proposal version writes to simulation workday custody #376; parent Implement the minimal AgentKernel, profile, and workday architecture platform#520
• Proposal / decision: N/A — operator-requested allocation acceptance repair, not a golden deliverable.
• Assignment / checkpoint: SDK diagnostic workday b91907f8-9053-4c63-991c-3005022f504e (stopped before handoff)
• Actor: Codex
• Human authority: @adrianwebb
• Agent / capacity provider: operator Codex task; dev2 managed acceptance
• Exact base ref: staging 3896003
• Exact head ref: 974665c

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Repair the observed acceptance failure through the existing runtime path. Local verification complete; merge after required Actions, then verify managed local recovery. No tags or releases.

Changes and commits

974665c: Reuse the existing writer and workday identity. Validate bound active project/proposal scope; use exact content provenance and a local workday ref. Simulation commits do not enter journals or replication; production authoring is unchanged.

Verification

24 focused tests pass; npm run build and npm run check:file-lengths pass; git diff --check passes. Managed handoff acceptance follows staging integration.

• I ran the narrowest relevant package verification and documented any checks that could not be run.

Risk and rollback

No database, credential or contract migration. Revert 974665c through a PR and rebuild the same managed live target. No purge or bootstrap reinstall.

Completion summary

Bounded repair verified locally. Integrated golden lifecycles remain unproven and are not claimed as complete by this PR.

AGPL committer authorization

Base-owned workflow retains provider-authenticated author authorization.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.