feat: replace revision counters with domain state contracts

Use content digests, key fingerprints, binding and trust identities, immutable mutation receipts, and observation tokens instead of state-update ordinals across API, storage, Runtime, and Web contracts.

Preserve historical replay and secret material through frozen migrations; preflight uncertain removals before cutover, resume provisioning receipts, validate encrypted migration candidates, and align fresh/upgraded schemas. Include reviewed regression fixes, generated artifacts, and validation evidence.

web/workspace/test/repository-ssh-connection-ui.test.ts

@@ -30,7 +30,7 @@ Deno.test("Repository SSH probe parser preserves the confirmation contract", ()
     port: 22,
     trust_state: "untrusted" as const,
     host_trust_id: "tofu-example.test-22",
-    expected_host_trust_revision: null,
+    expected_host_key_fingerprint: null,
     candidates: [
       {
         algorithm: "ssh-ed25519",
@@ -136,7 +136,7 @@ Deno.test("Repository SSH connection test requires an explicit host-key confirma
       "selectedRuntimeId",
       "candidate.fingerprint",
       "Confirm and trust selected host key",
-      "expected_host_trust_revision",
+      "expected_host_key_fingerprint",
       "requestConnectionTest('POST'",
       "requestConnectionTest('PUT'",
     ]