Require reliability admission before bootstrap writes

[Ohjjam]

Summary

• require active observer, provider, control-domain, checkpoint, maturity, and policy-activation rules before any bootstrap campaign write
• reconcile policy activation from two independently pinned Base Sepolia RPC operators
• hold autonomous workers without sending transactions until admission is proven
• canonicalize the public bootstrap specification hash across LF and CRLF checkouts

Verification

• npm test (248/248)
• live campaign status succeeds on Windows
• live campaign open fails closed with V44_BOOTSTRAP_ADMISSION_OBSERVATIONS_MISSING
• before/after live state remains jobId=null, paidTapool=0, transactionCount=4