fix: enforce installed distribution authority

[levifig]

Summary

• Separate project, explicit source-checkout, and installed-distribution roots so installed commands derive identity and packaged content from executable provenance.
• Make version, upgrade/configuration maintenance, and doctor fail closed instead of inheriting a stale checkout; preserve source authority for build and explicit development paths.
• Add stale-checkout and bare-binary regression coverage, document the authority contract, and regenerate the native candidate plus all coupled capability receipts.

Test plan

• Falsification: disabled the authority fix, confirmed the stale-checkout regression failed, restored the fix, and confirmed it passed.
• go test ./internal/cli -run 'TargetCapability|InstalledSmoke' -count=1
• go vet ./internal/cli ./cmd/loaf
• go test ./... -count=1
• npm run typecheck
• npm run test with isolated HOME, XDG paths, Git/Codex configuration, and no outer LOAF_DB
• npm run build
• loaf change check
• git diff --check
• Real isolated U8 smokes with Claude Code 2.1.207, Codex 0.144.1, and OpenCode 1.17.18; both tracked native candidates and all three receipts agree on SHA-256 5b76b90e835834bea3f4208cb8fa4e344951e43ab90f986837f09ac3d6eb2519.
• Independent Claude Fable 5 xhigh read-only review: APPROVE.

Non-blocking LOW follow-ups

• Homebrew exposure wording: internal/cli/distribution.go and the Change describe a bin symlink, while the formula uses bin.write_exec_script; executable-provenance resolution is unaffected.
• Setup documentation: setup's build phase uses source-checkout authority and its delegated install phase uses installed-distribution authority; behavior is fail-safe, but the Change under-documents this split authority.
• Direct degraded-path assertions: the doctor no-provenance skip message and configuration-check no-provenance fail-closed path lack dedicated assertions; both are structurally covered through the shared resolver and broader regression suite.