isolate upgrade handover audits

[PerishCode]

What changed

• route each self-upgrade handover through a deterministic attempt-scoped ops label
• retain the original stable-label seed helper for API compatibility
• replace the open-ended come-look instruction with a bounded current-state audit contract
• add regression coverage for same-attempt idempotency, cross-attempt isolation, and recovery after an exhausted prior room

Why

The beta.43 production rollout showed that the long-lived soul:<id>:ops strand repeatedly accumulated journal, artifact, schema, and incident dumps. A successful handover seed could immediately be followed by a provider-budget failure, forcing manual soul-authored compaction before the next release.

The concrete audit room is scratch state; exact history remains queryable by strand id. Scoping the label to the upgrade attempt prevents one audit from blocking later upgrades, while deterministic labels preserve idempotent retries of the same attempt.

Impact

New upgrade attempts get isolated handover strands named by soul:<id>:ops:upgrade:<attempt_id>. The handover prompt asks for only bounded doctor/service and attempt-relevant incident checks. Existing stable ops strands and compacted history remain untouched and queryable.

Validation

• cargo fmt --all -- --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace
• flavor check (0 deny; one existing rows.rs naming warning)
• production-derived regression: an exhausted same-attempt room rejects idempotently, while the next attempt seeds a different room and resolves the handover incident