fix: bind prepared provider identity and redact diagnostics

[jethac]

Summary

• Bind prepared storage readiness and plan candidates to the stable local registry identity plus the exact provider volume identity and storage facts.
• Revalidate the bound storage identity before first submit and preserve the binding through dispatch, replay, and restart paths.
• Redact private local/provider storage identifiers and related authority data from public prepared-volume diagnostics.

Validation

• python -m pytest -q — 1101 passed, 6 skipped.
• Base is main; accepted implementation head is the pushed branch tip.
• No provider, BWS, RunPod, or paid-resource operations were performed.

Safety

• Prepared and cold/ephemeral paths retain their existing behavior.
• Mismatched, replaced, missing, or drifted storage authority rejects atomically before job/event/lease/provider mutation.
• Public preflight responses use fixed safe wording and do not serialize private storage identifiers.