Fix actor-private scholarly metadata workflow authority

[witbrock]

Outcome

Fixes JVNAUTOSCI-2649's canonical scholarly-metadata workflow so an authenticated actor can create or reuse an exact user-private paper representation without spurious per-effect delegation ceremony, while retaining stronger authority boundaries for shared and privileged effects.

Root cause

The ontology publication boundary rejected every agent-labelled mutation without an exact delegation before evaluating the authenticated actor's direct authority. Direct adaptive calls could mint that token, but normal durable workflow execution could not. Existing positive tests manually injected a delegation-shaped value and therefore did not exercise the supported production path.

The failed turn also exposed neighbouring end-to-end defects in paper identity/retry, canonical text-value read-back, nested effect identity, custom-handler scope containment, and reporting that confused a workflow-instance read with domain-target verification.

Changes

• Admit only server-bound workflow effects that have already passed the workflow write ceiling and whose exact source/publication contexts are all the authenticated actor's user-private context.
• Preserve exact delegation for real authority handoff, shared/global/historical/other-user/governance/sessionless and otherwise privileged effects.
• Stabilise top-level and nested workflow receipt identities across replay.
• Make scholarly paper identity actor-scoped and stable across DOI, arXiv, source URI, or a discriminating bibliographic fingerprint; prevent title-only merging.
• Preflight all existing targets mutated by the shipped custom scholarly workflow and require preprovisioned schema support.
• Correct canonical text-value read-back.
• Distinguish workflow-instance operational read-back from scholarly domain verification in reports and failure capsules.
• Add the two Reliability Ratchet source articles and an evidence-only RR-001 case; keep repair selection and status in Jira.
• Add compact repository guidance requiring a normal authorised positive path and the weakest adequate authority carrier.

Validation

• 257 backend tests passed
• 13 frontend tests passed
• 2 unrelated opt-in live arXiv tests skipped
• Ruff E9/F, Python compilation, seed JSON, diff whitespace, and secret-pattern checks passed
• Independent review found no candidate-caused security, authority, compatibility, or merge stop-ship

Bounded residuals

This does not claim system-wide centralisation of every scholarly mutation. Existing custom handlers on this workflow are scope-contained but do not yet share the central MCP receipt path. A separate legacy MCP/stdio materialisation route remains outside this claim. Receipt identity is not generalised to changed-argument repeated occurrences of the same tool in one state.

Post-merge deployment must verify seed-v26 activation/read-back and an actor-private durable workflow run plus duplicate-free retry before Jira is closed.