refactor(onboard): make recovery and sandbox entry strict

## Ownership

@cv owns this issue.

Do not start, assign, or submit this work unless @cv transfers ownership in this issue.

## Problem

Initial and core flow slices still use compatibility execution when the durable machine is ahead of a slice entry.

Live sandbox decisions can also read legacy session fields after a versioned checkpoint contains the authoritative decision.

The sandbox flow does not yet own exact `sandbox` entry through the strict runner.

## Desired behavior

- Recover an ahead-state initial or core entry through explicit prerequisite repair.
- Keep the durable entry state unchanged during repair.
- Read checkpoint decisions before legacy session fields.
- Invalidate a stale computed result before it can update durable state.
- Give the strict runner exact `sandbox` entry and branch-transition ownership.
- Revalidate a live receipt before the runner skips an effect.

## Change boundary

This work changes internal routing and recovery ownership.

It must not change commands, output, configuration, or supported onboarding results.

Compatibility for normalized older sessions can remain only where a current migration requires it.

## Security

Repairs and results must not persist credentials or secret-bearing URLs.

Resume must fail closed when a checkpoint is corrupt, unsupported, or inconsistent with a live binding.

## Validation

- Characterize ahead-state fresh and resumed entries.
- Test update-free repair and durable-entry preservation.
- Test checkpoint precedence and stale-result invalidation.
- Test one sandbox effect and one branch transition at exact `sandbox` entry.
- Test failure before any undeclared effect.

## Completion

The strict runner owns exact `sandbox` entry. Initial and core ahead-state recovery no longer depends on compatibility replay.