Stage-checkpoint hardening follow-ups from #599 review

[MaxGhenis]

Two advisory findings from the #599 round-1 audit (fable, 8/3 — full log in the review trail), both non-blocking, tracked here so they don't evaporate:

1. QRF-init preemption window leaves a hard-refused unbound directory. A container killed during primary-QRF directory initialization leaves a directory the loader correctly refuses to trust — but recovery requires manual deletion. Harden: name the condition in the refusal error and have the builder quarantine-and-rebuild automatically (the fail-closed behavior is right; only the manual step should go).
2. Four serializable predictor registries are covered by the materializer version ledger rather than bound into the checkpoint identity. The ledger discipline works (it's the dense tool's doctrine), but these four are serializable and could be bound mechanically, removing a hand-bump obligation. Bind them into the identity digest.

Part of #578 increment 2 hygiene.