feat: replace revision counters with domain state contracts

Use content digests, key fingerprints, binding and trust identities, immutable mutation receipts, and observation tokens instead of state-update ordinals across API, storage, Runtime, and Web contracts.

Preserve historical replay and secret material through frozen migrations; preflight uncertain removals before cutover, resume provisioning receipts, validate encrypted migration candidates, and align fresh/upgraded schemas. Include reviewed regression fixes, generated artifacts, and validation evidence.

crates/standalone/tests/host.rs

@@ -487,7 +487,7 @@ async fn standalone_restore_recovers_only_a_proven_stale_lease() -> TestResult {
             source: manifest::ProfileRegistrySource::User,
             name: "user-standalone".to_string(),
             path: None,
-            provenance: Some("user-config-revision-7".to_string()),
+            provenance: Some("user-config-digest".to_string()),
         },
         profile: Some(manifest::ProfileMetadata {
             name: Some("User standalone".to_string()),