Stage-checkpoint hardening follow-ups from #599 review

Two advisory findings from the #599 round-1 audit (fable, 8/3 — full log in the review trail), both non-blocking, tracked here so they don't evaporate:

1. QRF-init preemption window leaves a hard-refused unbound directory. A container killed during primary-QRF directory initialization leaves a directory the loader correctly refuses to trust — but recovery requires manual deletion. Harden: name the condition in the refusal error and have the builder quarantine-and-rebuild automatically (the fail-closed behavior is right; only the manual step should go).
2. Four serializable predictor registries are covered by the materializer version ledger rather than bound into the checkpoint identity. The ledger discipline works (it's the dense tool's doctrine), but these four are serializable and could be bound mechanically, removing a hand-bump obligation. Bind them into the identity digest.

Part of #578 increment 2 hygiene.

Start with the #599 round-1 audit and the #578 increment 2 hygiene context. Trace QRF-init directory initialization through the builder and loader, then inspect the materializer version ledger and checkpoint identity digest. Done means failed initialization is quarantined and rebuilt automatically, and the four serializable predictor registries are included in the identity digest.