fix: close readiness assessment surface roles

[auscaster]

Summary

• declare the existing first-party authentication resources as authentication surfaces
• declare the exact hyperscaler asynchronous status resources as recovery surfaces
• close current r5 assessment selector semantics for the existing 20-vendor cohort

Local proof

• full repository declaration validation: 20 vendors / 20 declarations
• full-tree r5 assessment planning succeeds against the exact candidate commit
• no new vendors, endpoints, scoring policy, or publication lane