fix: bind action history plans to retained source context #325

Part of #321, exposed while implementing #324's required reader replay boundary. Base: merged #323 at a808b31755b8e24088b0c62ec6e88e620b40243b.

The original four-native-process replay reaches block 33 under a replacement reader, then fails the immutable h45actiontx1 transaction link. The old and new source admissions are different, but their history plans currently omit that retained input context and therefore share a plan/transaction link.

Saved observations isolate the difference: global sequence 41, capture, transaction, contract data, metadata fingerprint and producer/target are unchanged. Only protocol.selectionId and protocol.native.linkId change with the new physical source selection. A diagnostic substitution of precisely those two fields reproduces the second stored fragment's full document fingerprint. The immutable-link check is correctly refusing two different complete document fingerprints under one plan; do not bypass it or strip provenance from effect hashing.

Acceptance:

• New retained source records explicitly bind the history plan to their immutable retained source identity, so independent input contexts can retain their own exact output provenance.
• Keep schema-1 retained sources and their existing plan/admission/link identities readable and retryable. Use an explicit new retained-source schema for newly produced scoped plans, with strict additive plan validation.
• Preserve the complete document fingerprint and immutable transaction/seal conflict checks within the same plan. Scope is not permission to accept arbitrary output or transfer fresh receipt/end authority.
• Keep source inventory derivation, original dispatch membership, actual configured-copy writes, current configuration/target/canonical/source guards, authentic ends, and unknown broker settlement.
• Retain the original red native observation and prove fresh current-source recovery of original block 33, followed by block-34 continuation/redelivery, while the old physical operation stays held. Old unresolved ends cannot borrow the new result.
• Run native Node24/26, source/whole checks and builds, root/CI and independent full-delta reviews. Old history stays usable without a full reindex.

No dependency, operator-default, reader grant/budget/deadline, ancestry or production service change. Source/provenance controls remain explicitly labeled. Builtin Antelope's reversible bridge, combined live recovery, full original replay/capacity and complete release acceptance remain open.

Completed in #326, merged into the still-draft #289 at ec5a40a7 with the same tree as reviewed 418137f4. Complete checks/build, final native Node 24/26 controls, local full suite and all nine exact-head CI jobs pass; complete-delta Spec/Standards and recorded-evidence reviews are complete. Original failed observations and the corrected report-copy counterexample remain preserved. See #321 for shared evidence and its remaining builtin Antelope reversible gate. Combined live recovery, full original replay/capacity and release acceptance remain open.