feat(phase-a): derive public gate authority

[forkwright]

Summary

• make contracts/phase-a.toml the public typed authority for the exact http2-over-noise → effective-acl → data-plane order and derive every public/agent projection from it
• enforce bounded blocked-state activation guards and receipt/provenance groundwork; disable every completion transition until Prove the capability-version handshake against an independent TS2021 oracle #122 lands authenticated independent-oracle authority
• reject malformed graph shapes and unknown contract keys, and route the validator plus negative matrix through an always-terminal gate / gate, including docs-only changes and failed preflight paths

Verification

• git diff --check
• python3 -B tools/render_phase_a.py --check
• GitHub CI 33025592135
• GitHub Security 33025592156
• GitHub Gate Attestation 33025592720

Local builds, tests, and gates were not run; the public GitHub workflows exercised formatting, compilation, linting, tests, the contract negative suite, and security checks.

Refs #118.

Completion authority remains unavailable pending #122.