fix(queue): bind canonical promotion receipts

[Joncallim]

Source Issue

Issue: #179

Parent

• Parent PR: fix(queue): upgrade legacy retry members atomically #295
• Exact parent commit: c74d4275290cc4c6e266b26a03fe9f822df4335b
• Base branch: codex/pr198-producer-5a2-r3a-retry-upgrade
• Task: PRODUCER-5A2-R3A-R6-CANONICAL-RECEIPT-BINDING

Summary

• Require a source-absent canonical (occurrence) retry replay receipt to name the occurrence ID already embedded in the scanned envelope.
• Preserve concurrent legacy-upgrade convergence, where different contenders may generate different candidate occurrence IDs and the first valid winner remains authoritative.
• Keep canonical mismatches fatal through the existing receipt-integrity path without deleting or rewriting the coherent mismatched receipt pair.

Evidence

• Focused queue/output closure: 21/21 passed.
• Disposable real Redis proof: 3/3 passed, covering task, approval, and answers canonical mismatch/match cases plus existing legacy concurrency, historical-v2, ownership, pruning, poison, response-loss, clock, and capacity paths.
• Full local unit suite: 1,689 passed; 7 pre-existing skips outside the dedicated Redis proof.
• Changed-file ESLint: passed.
• TypeScript --noEmit: passed.
• Production build: passed.
• git diff --check: passed.

Mutation sensitivity

Temporarily removing the canonical occurrence-ID equality guard made the real Redis suite fail at the new canonical mismatch assertion (failure was undefined instead of the fixed receipt-integrity error). The guard was restored and the focused 21/21 plus real Redis 3/3 suites passed again.

Scope

Only the three assigned files changed. No runtime catch expansion, key/schema change, scan, raw receipt payload, documentation change, or parent-thread mutation is included.