Fused private-review authority activation foundation

[hiidkaboutyou-spec]

Summary

Adds private-review-only authority-switch plumbing for future Fused delivery while keeping production authority OFF/LEGACY.

Safety properties

• default/missing/malformed authority flag => LEGACY
• deterministic bounded CANARY model, not enabled in production
• hard kill switch
• pre-send failures may fall back to legacy
• after any fused receipt, full legacy fallback is forbidden
• reuses MessageDeliveryStore + MediaDeliveryLedger; no third receipt system
• conservative body resolver: genuine correlated Final Edit or current authoritative Draft; style remains shadow
• strict plan/readiness/Telegram-limit validation
• executor accepts no arbitrary/public chat target and reuses existing private transport helpers
• runtime integration is decision-only after current legacy delivery with network_execution_enabled=false
• no public Forward, no auto-forward, no retrieval/Fanfic/dependency/hosting changes

Validation

Natural pull_request CI is expected to run full project validation plus the new 50-case Fused Authority Activation benchmark and all prior foundation benchmarks. No workflow_dispatch or manual rerun will be used.

Production defaults remain:

• FUSED PRIVATE REVIEW AUTHORITY = OFF / LEGACY
• CANARY = not enabled
• current Update-oriented private-review delivery = authoritative
• ForwardReadyPackage / Fused plan / Style = shadow
• AUTO_LEARN = false