Instrument reset-epoch token fingerprint collisions

[iam-brain]

Question

Add privacy-safe, shadow-only diagnostics for cumulative token snapshots that revisit an existing (last,total) fingerprint after an intervening counter regression within a physical rollout. Measure affected observations and UTC-day token deltas on frozen histories before deciding whether reset epochs belong in authoritative ledger identity. Do not change production totals or weaken fork-copy deduplication without corpus evidence.

Acceptance

• Diagnostics are aggregate-only and cannot expose rollout identities, paths, models, or contents.
• Existing ledger totals remain byte-for-byte unchanged.
• Tests cover legitimate reset/revisit candidates, ordinary duplicates, fork copies, and deterministic ordering.
• Frozen-corpus output states whether the heuristic could explain a material part of the July 9 residual.

Successor to #23 and prerequisite evidence for #20.

[iam-brain]

Implemented and locally validated in #41. The frozen replay found zero reset-epoch candidate tokens on July 9, so this remains shadow-only diagnostic evidence and does not alter selected totals.