fix: isolate recipe authority by kitchen activation

[Trecek]

Closing and reopening a kitchen within a fixed campaign previously reused the retired recipe namespace, preventing fresh recipe delivery. This change mints a typed activation identity for each open lifecycle and keys recipe artifacts, generation records, and page-plan caches by it. Campaign lineage and captured values stay available across reopen, while retired pull handles and initialization/execution credentials remain invalid.

The existing identity authority now owns retirement as well as activation. Regression tests cover same-campaign reopen, active-open reseeding, sibling contexts, and retirement failures. The authority guard prevents additional mint/retirement sites, persistence failures log their cause, and the glossary documents the identity lifetimes.

Validation:

• Both implementation parts independently passed pre-commit run --all-files and the configured task test-local-gate via MCP.
• Final gate: 51,451 passed, 617 skipped, 29 xfailed.
• Linux and macOS type checks passed.
• Separate temporary source mutations for unauthorized minting and retirement each failed only the authority guard. Both mutations were restored before the final passing gate.

Closes #5270.