Detect and revoke an origin floor an applied frame violates #1089

Problem

With level-2 floor certificates (harper-pro#922 items 3–4), a route resumes exactly below a stored floor, so a transaction an origin commits below a floor it certified is applied like any late commit instead of being filtered by the sender. Nothing on the apply path compares a live frame's origin key with the stored floor for that origin, so a violated certificate (an older binary writing below a saved floor, a clock step the producer did not ratchet past) is not diagnosed; the receiver's checkpoints then certify a boundary the origin broke.

Proposal

On a live frame past the route's resume position (not a replay, base copy or duplicate batch), compare the frame's origin key with the stored closedFloor for that origin; on a violation log once per origin and revoke the floor through the existing sticky path (originFloorRevocations → core clears the floor and sets floorRevoked), which refuses later checkpoint resumes with 410. Needs a per-connection cache of the stored floors by origin id so the comparison costs no store read per frame.

Where

replication/replicationConnection.ts apply path, beside noteOriginProgress; the revocation plumbing exists. Deferred from the items 3–4 design (diagnostics only; the correctness guarantee rests on the origin's ratchet and the durable advertisement).

_{🤖 Generated by Claude Fable 5.1; posted via @kriszyp.}