fix(auth): bind local-node eject to replica proof

[LiranCohen]

Summary

• persist v2 ejection markers bound to a stable source-replica ID, canonical registration topology, and converged drain manifest
• inspect retired message and task stores before remote-mode boot; legacy, changed, or unreadable proofs fall back locally while preserving pairing
• fail drains when any registered DID resolves no active sync projection

This intentionally does not delete local stores. It establishes the fail-closed source-replica proof needed before destination storage-generation binding and cross-context write fencing can make deletion safe in #1166.

Test plan

• bun run lint
• bun run build
• packages/auth: bun run test:node (536 pass)
• packages/agent: bun run test:node (1327 pass)
• bunx changeset status

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
98.2% Coverage on New Code
1.6% Duplication on New Code

See analysis details on SonarQube Cloud