refactor(onboard): add lifecycle receipts and compensation

## Ownership

@cv owns this issue.

Do not start, assign, or submit this work unless @cv transfers ownership in this issue.

## Problem

Several lifecycle paths apply multiple external effects without one durable recovery contract.

An interruption can leave gateway providers, registry rows, policy state, or channel state ahead of the recorded checkpoint.

Backup and restore policy also differs between rebuild, live recreation, and not-ready repair.

## Desired behavior

- Define durable, secret-free receipts for the current lifecycle effect groups.
- Revalidate each receipt against its live postcondition before a skip.
- Use one backup and restore policy for rebuild, recreation, and repair.
- Restore or reconcile registry state after an interrupted removal.
- Compensate a failed multi-effect apply when the previous state remains valid.
- Report a partial apply with a specific recovery action when compensation cannot complete.

## Change boundary

Add receipts only for existing effects and current recovery consumers.

Do not implement health-before-delete replacement or atomic swap.

Do not add a general transaction framework.

## Security

Receipts must contain identifiers, digests, and logical bindings only.

Compensation must not copy credential values into the session, registry, logs, or events.

## Validation

- Add crash-point tests before and after each covered effect group.
- Test postcondition revalidation before a skip.
- Test compensation success and compensation failure.
- Test backup-policy parity across rebuild, recreation, and repair.
- Test that a resumed apply does not duplicate a destructive create.

## Completion

Covered lifecycle effects have a durable receipt or a documented forward-only recovery contract.