Controller refresh authenticates plan-time prompts against the unsealed run-root plan.json

Found while landing #1002; pre-existing on main, not introduced by that fix.

currentControllerPromptBindings (packages/runtime/src/smithers.ts, formerly currentControllerTasks) authenticates each retained prompt snapshot against a row read from <runRoot>/plan.json — the unsealed run-root copy — rather than the sealed controls/plan.json. verifyDynamicRuntimeMaterialization already uses the sealed copy (workflow-integrity.ts:605); the refresh path does not.

An adversarial probe forged a rendered_prompts row with an attacker-chosen rendered_prompt_snapshot_path and a matching rendered_prompt_digest. Both the fix branch and clean main bound the forged prompt into the refreshed controller source and both still admitted the run:

ADV22: ACCEPTED spec= .../runs/adv22/prompt-snapshots/forged.md
ADV22 admission after forged plan: true []

The digest gate is self-referential: it checks the snapshot against a digest recorded in the same unauthenticated document. Because resume is ungated, the forged prompt is bound and read before any gated command runs, so a later tasks.json divergence would not save it either.

Related, same root: the #990 deferred-prompt exemption is an unauthenticated bypass. Setting deferredPromptGroups plus an arbitrary renderedPromptPath in runtime-base-tasks.json skips the digest gate entirely on both trees.

Both route through currentControllerBaseTasks trusting the run-root smithers/runtime-base-tasks.json rather than the sealed controls/runtime-base-tasks.json — that selection is #991's.

Fix direction: authenticate the run-root plan row against controls/plan.json before rebinding, and give the deferred-prompt exemption a positive authentication rather than a skip.

Start in packages/runtime/src/smithers.ts at currentControllerPromptBindings and currentControllerBaseTasks, then compare their plan and runtime-base-tasks selection with verifyDynamicRuntimeMaterialization in workflow-integrity.ts:605. Reproduce the ADV22 forged-prompt probe and trace the deferred-prompt path. Done means refresh authenticates against controls/plan.json and the deferred-prompt exemption has positive authentication rather than skipping the digest gate.