Bind CK-07R1 clean committed CI transition

[douglasmonsky]

Summary

• add the versioned CK-07R1 V2 clean-commit authority for exact dirty 18+7 and clean committed 25-path representations
• preserve consumed-token, no-new-run, no-retry, no-receipt, and permitted-not-accepted semantics
• create the lexical repository .venv deterministically in matrix CI after the existing dev install and before authority verification
• reconcile all historical authority consumers without changing accepted V1 or CK-QG1 authority bytes

Validation

• 240 focused authority/lifecycle/CK-QG1/CK-08R3A tests passed
• exact authority and retained 18+7 combined preflight passed
• just vc passed: 1,486 tests passed, 1 skipped; 13 performance invariants; Ruff, mypy, Pyright, release, build, and dist checks green
• privacy, secret, and diff checks passed
• sole bounded reviewer correction pass CLEAN after fixing one digest-check indentation finding

No qualification command, child launch, token action, runtime artifact mutation, receipt, PR #394 mutation, cleanup, or downstream dispatch occurred.