feat: replace revision counters with domain state contracts

Use content digests, key fingerprints, binding and trust identities, immutable mutation receipts, and observation tokens instead of state-update ordinals across API, storage, Runtime, and Web contracts.

Preserve historical replay and secret material through frozen migrations; preflight uncertain removals before cutover, resume provisioning receipts, validate encrypted migration candidates, and align fresh/upgraded schemas. Include reviewed regression fixes, generated artifacts, and validation evidence.

web/workspace/tests/runtime-connection.test.ts

@@ -19,7 +19,7 @@ function compatibleResponse(): Record<string, unknown> {
   return {
     workspace_id: "workspace-a",
     runtime_id: "runtime-a",
-    binding_revision: 3,
+    binding_id: "binding-3",
     connection_state: "verified",
     verification: null,
     checked_at: "2026-09-01T12:00:00Z",
@@ -67,12 +67,11 @@ Deno.test("runtime connection response rejects unknown fields and incoherent com
         verified_at: "2026-09-01T12:00:00Z",
         last_checked_at: "2026-09-01T12:00:01Z",
         last_outcome: "verified",
-        binding_revision: 2,
+        binding_id: "binding-2",
         workspace_key_id: "WK-a",
-        workspace_identity_revision: 1,
-        workspace_trust_generation: 1,
+        workspace_public_key_fingerprint: "sha256:workspace",
+        workspace_trust_id: "trust-a",
         runtime_public_key_fingerprint: "sha256:runtime",
-        runtime_identity_revision: 1,
       },
     }),
     null,