Harden external action provenance and recovery

[mzored]

Summary

• Adds an isolated, provenance-bound external action path with deterministic confirmation and recovery behavior.
• Preserves legacy public action identities through migration and durable retry paths.
• Strengthens erasure convergence and fixed write-only controller cleanup.

Verification

• Full test suite: 787 passed.
• Changed-surface suite: 33 passed.
• Focused migration/RPC/recovery/erasure suite: 22 passed.
• Scoped strict mypy: passed.
• Formatting and lint checks: passed.
• Independent boundary review: clean.

Repository-wide mypy still reports an existing baseline of 512 errors across 23 unrelated files; the changed boundary sources are clean under strict checking.

No merge or deployment is included in this PR.