Refine compute-control mixed identity paths

[TacoRocket]

What changed

• tightened compute-control mixed-identity admission so corroborated identity choice can land as an exact row and unresolved cases fall back to bounded candidate rows instead of going silent
• graduated the system-assigned fixture cases used by compute-control and refreshed principals/permissions goldens and table expectations to match the new fixture truth
• added repeatable truthfulness helpers and review-driven cleanup around compute-control tests, help coverage, and mixed-identity resolver plumbing

Why

This keeps compute-control decision-complete without overclaiming identity choice, and it makes the saved lab fixture reflect the stronger-control joins the feature now depends on.

Validation

• python3 -m pytest tests/test_compute_control.py tests/test_cli_smoke.py tests/test_collectors.py::test_collect_permissions tests/test_collectors.py::test_collect_principals tests/test_chain_semantics.py tests/test_help.py -q
• python3 -m pytest tests/test_golden_outputs.py::test_golden_outputs tests/test_terminal_ux.py::test_principals_table_mode_uses_curated_columns tests/test_terminal_ux.py::test_permissions_table_mode_surfaces_next_review -q
• guarded pre-push checks via git push --force-with-lease