Fix missing recipe digests and checkpoint carrier delivery

[Trecek]

Segmented recipe execution could stall because completion receipts omitted later-step digests and some checkpoint tools never delivered their next segment. Completion receipts now carry the complete execution credential, and missing or mismatched credential rejections identify the step, the live completion call, and the digest key to use.

Checkpoint carriers are attached by the shared response wrapper using registry-declared outcome readers and step sources. This wires bind_plan_set and review receipt verification, covers early returns and exception responses, and removes per-handler attachment code. When an inline success carrier would exceed the byte cap, a pull-only carrier preserves the tool outputs and recoverable spill content.

Validation:

• Both phases independently passed the configured task test-local-gate; the final run passed with 48,326 tests passing.
• pre-commit run --all-files passed, including type, complexity, architecture, and secret checks.
• Added a response-only plan → bind → verify regression, registry/wrapper conformance checks, real-handler outcome checks, and carrier size/spill regressions. Size coverage follows actual success crossings, including already-pull-only routes and empty non-crossing carriers.

Closes #5273.