fix(reconciliation): make v1 MISSING-only

[Pigbibi]

Summary

• restrict qsl.reconciliation_record.v1 to MISSING only
• reject observer, observation, comparison, mismatch, and freshness material recursively
• retain exact DeploymentBundle, Activation, target, expected identity, deterministic digest, and false runtime/fill/capital assertions

Security regressions

• rejects self-asserted observer identity with recomputed unkeyed hashes
• rejects a fresh envelope around a stale observation because v1 accepts no observed status or material

Validation

• tests-first RED reproduced on exact base 21dc68bc71dd7229cdbf2b7c13313a2642199a33
• focused DeploymentBundle + Activation + Reconciliation: 33 passed
• full Python suite: 164 passed
• fresh 14-consumer dependency matrix: 30 files, 0 issues
• runtime/config, Ruff, compileall, JSON Schema, temporary package, actionlint, Node, scope, secret, and deploy-overlap gates passed

Contract/static correction only. No apply, config-sync, runtime wiring, provider, credential, broker, order, capital, paper, shadow, or live action.