fix(herdr): Partition-loader docstring drift, brief TOCTOU, and validator-output provenance

Summary

Three items raised on #456 and deferred there (advisory; the PR's gates were green and the blocking findings were fixed in-round).

1. Stale docstring. partition.load_validated's docstring says the result "carries the slices with their RESOLVED paths". The slices carry globs at every stage — plan emits them as slice_paths, compose-briefs.sh renders them, the worker resolves them. Only validate()'s return is resolved paths, and the loader discards it. One sentence, but it is what made two reviewers read the loader as accepting a broader boundary than intended.

2. Brief time-of-check/time-of-use gap. _require_bound_slices reads each brief at preflight; assign.apply re-reads the path at send. A brief edited in between dispatches unchecked. Shared with every other apply preflight (readiness, tier, qualification), so the fix is to pass checked CONTENT to the send rather than a path — an assign.apply interface change touching every caller.

3. No provenance on the validator's output. load_validated accepts any file carrying a changed list and re-proves the partition over that set. A caller who supplies a smaller self-consistent set gets a partition genuinely valid over it. plan has no repo, base or head and cannot check the round diff. Closing this means signing validate-partition's output and verifying it here — including deciding what happens when no key is configured.

Test plan

• Docstring describes what the loader returns
• (2) A brief edited between preflight and send is refused
• (3) An unsigned or mis-signed validator output is refused, with the no-key behavior documented

Start by tracing partition.load_validated, validate(), _require_bound_slices, and assign.apply, including every caller of the apply interface; inspect compose-briefs.sh and the validate-partition output path. Done means the loader docstring matches its return, checked brief content is used through send, and unsigned or mis-signed validator output follows documented no-key behavior and is refused when required.