Concrete-input LWW is unauthenticated and stamp authority is duplicated across fields

Reviewed at `26995a3`.

The concrete-input LWW winner is decided by client-supplied `base_version` and `actor` (`src/stamps.ts:42,53`; `src/applier.ts:85`) with no bounds check, so a client can set an arbitrarily high `base_version` to always win. Separately, each op carries `actor`, `base_version`, AND a `stamp` tuple of the same values (`src/types.ts:64`); `stampKey()` prefers `stamp` and falls back to the envelope with no equality check (`src/stamps.ts:53-58`), so contradictory authority fields are representable and different consumers can read different values.

Direction (V1): validate/clamp `base_version` against the doc's known version at ingest; derive `actor` from the authenticated caller rather than trusting the op; assert `stamp` agrees with the envelope or drop one of the two representations.

Start by reading src/stamps.ts:42,53-58, src/applier.ts:85, and the operation shape in src/types.ts:64, then trace where operations are ingested against the document version. Confirm that client-controlled authority cannot bypass version checks and that the envelope and stamp cannot disagree; done means contradictory or out-of-bounds authority is rejected or normalized consistently.

Written by the indexing model from the issue text.