fix: bind Web Push mutations to exact authority

WP-01: a CAS receipt is only evidence when it names the expected key and the
exact next revision. Write and remove now share one validator, so a stale or
arbitrary repository receipt can no longer be packaged as a confirmed control.

WP-05: a pre-aborted command records the operation the caller requested instead
of always reporting an inspection.

WP-06: bounded fan-out is reported honestly. The subscriptionchange client
handoff and the notification cleanup both emit countBucket and truncated, and an
incomplete cleanup returns { complete: false } and is observed as DEGRADED
separately from revoke authority.

WP-07: the user-visible native notification effect is tracked through
NOT_APPLIED, MAYBE_APPLIED and CONFIRMED phases and surfaced as observation
evidence, never as retry authorization.

WP-02, WP-03 and WP-04 stay open: they need the V2 wire protocol with server
request-shape negotiation, which belongs to the versioned-migration task rather
than this correctness pass. The ledger records them as DEFERRED_TO_MIGRATION.

Web Push remains NOT_SELECTED and AVAILABLE_NOT_COMPOSED.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/web-push-worker-runtime.test.ts

@@ -445,6 +445,8 @@ describe("Web Push worker runtime", () => {
       event: "web_push_subscription_rotated",
       outcome: "DEGRADED",
       reason: "DEADLINE_EXCEEDED",
+      countBucket: expect.any(String),
+      truncated: expect.any(Boolean),
     });
     runtime.dispose();
   });
@@ -489,6 +491,8 @@ describe("Web Push worker runtime", () => {
       event: "web_push_subscription_rotated",
       outcome: "DEGRADED",
       reason: "ABORTED",
+      countBucket: expect.any(String),
+      truncated: expect.any(Boolean),
     });
 
     const throwingStore = await activeFence();
@@ -540,6 +544,8 @@ describe("Web Push worker runtime", () => {
       event: "web_push_subscription_rotated",
       outcome: "DEGRADED",
       reason: "ABORTED",
+      countBucket: expect.any(String),
+      truncated: expect.any(Boolean),
     });
     throwingRuntime.dispose();
   });