fix: admit only creditable pipeline tracker dependencies

[Trecek]

Tracker initialization accepts prerequisites such as bootstrap_clone that cannot earn completion credit, leaving a pipeline unable to progress. Kitchen-created trackers also omit the incarnation identity required to bind completion credit.

This change requires a shared validated TrackerInitialization payload at both tracker writers. It rejects unknown steps, non-run_skill endpoints, self-dependencies, and cycles before writing a tracker, with bounded diagnostics and recovery guidance. Server-derived edges use the same eligibility rule, and manual initialization combines them with caller-requested dependencies.

Kitchen trackers now receive a completion identity while retaining existing identities and statuses on re-initialization. Tracker mutations cannot change admitted dependencies. Receipt acknowledgement and completion-credit guards remain enforced.

Validation:

• Captured the planned failing-test run before implementation.
• pre-commit run --all-files passed.
• Configured test_check / task test-local-gate passed: 47,046 passed, 601 skipped, 29 xfailed.
• Regression tests cover the issue's plan -> clone mapping, both creation paths through acknowledged credit, unchanged completion refusals, and the writer/gate/credit call inventory.

Closes #5266

Response to the implementation audit

• Step 1.4 Case 4: Added test_run_skill_predecessor_creates_dependency with explicitly typed run_skill endpoints and the exact expected graph. The existing test already covered the behavior, but the plan requested a separate new case; that explicit addition was missing.
• Recovery wording: Retained the executable record_pipeline_step(op='init') call form. It preserves all four required facts: omit dependencies or supply only skill-to-skill edges, the server adds recipe dependencies, and other steps never earn completion credit.
• Recipe cascade: The reported omission is incorrect. server/test_record_pipeline_step_complete.py is already in LAYER_CASCADE_CONSERVATIVE["recipe"] at tests/_test_filter.py:1365, under the recipe key beginning at line 1323. AST inspection confirms membership. No duplicate entry is needed.
• FinalizedRecipeStep import: Required by Step 2.7 so dependency-bearing fixtures have a validated run_skill tool kind. This uses the public core gateway and is in the stated scope.
• Kitchen backend fixture: Typed skill steps activate dispatch-feasibility preflight, which needs concrete backend guard capabilities. The bare mock caused four kitchen tests to fail; using the configured backend restores valid fixture capabilities without bypassing production checks. The subsequent configured gate passed.

The explicit positive test is the only tracked-code change in this audit response. The other findings are explained above. This update does not claim a new formal /audit-impl verdict.

Audit-response validation: pre-commit run --all-files passed; configured test_check / task test-local-gate passed with 47,047 passed, 601 skipped, 29 xfailed. Explicit Case 4 test added in commit 8971744997f5a966a97fb71693005442d4b93268.