Decode-free semantic readiness: seal source-side commitments on CodeGenerationManifestV1

[ScriptedAlchemy]

Context

#753 readiness now compares vectors.source_manifest_digest() with the serving generation's ProjectionBatchRequestV1.changes.manifest_digest or the full-replay recomputed digest (vectors_serve_source, crates/tracedecay-usecases/src/semantic_runtime/production.rs). Both sides are reachable today only by materialising (decoding) the serving generation via serving_code_scope, the decoded consumer the restart lane wants gone.

Shape (architecture review, 2026-09-06)

• The source-side commitment belongs on the sealed code-generation contract: compute the required digests once during sealing, authenticate them with the generation, record them on CodeGenerationManifestV1, and expose them read-only from the seated text level (LatestCodeTextGenerationV1 / VerifiedSealedTextGenerationMetadataV1). No model/profile lifecycle state on the manifest.
• Keep the vector artifact's accepted-source record: sealed metadata answers "what source does this generation represent", vector provenance answers "what source produced these vectors". Readiness compares two independently authenticated records; never copy a digest from the candidate vector record into serving metadata (that recreates the self-comparison that caused the Semantic activation has no shipped operator journey; model 'loading' state persists 16+ min past load_deadline_ms with no typed failure; day-old eval client gets connection reset #753 stall).
• ChangedCodeChunkSetV1::compute_digest() includes from_generation, to_generation and the added/deleted/reused partitions, so an incremental digest and a full-replay digest are not interchangeable. Preserve both supported representations explicitly.
• Historical manifests without the fields need explicit verified migration or typed unavailability, not a fabricated default (revision <6 sealed generations already refuse and rebuild).

Acceptance

• Semantic readiness/restore decisions read only seated metadata plus the vector provenance record; no decoded generation on that path.
• Same source identity → activation remains valid across generation id churn; different source identity → typed refusal.
• Semantic activation journey (activate → ready → strict query → restart → query → rollback → retry) green.

Targets codex/tracedecay-total-redesign-plan-reopened (#707). Refs #753, #908.