fix: deliver checkpoint continuations from registry success routes

[Trecek]

Successful checkpoint responses could omit downstream recipe steps when routing through a fallback, including check_changes → test. Derive success reachability from registry outcome metadata and ordered result arms, and expand manual pull closures to whole segments so they deliver the same unit as inline bodies.

Adds wrapped-condition and registry-substitution tests, compiled-recipe invariants, production carrier and manual-pull regressions for implementation/remediation, and delivery-authority checks. Documents conservative delivery semantics in ADR-0004.

Validation:

• All-files pre-commit passed.
• Configured task test-local-gate: 31,650 passed, 3 failed, with 598 skipped and 15 xfailed.
• Production sweep: 198 valid ingredient configurations, 54 distinct projections, 8,620 success-delivery obligations with none missing, and no carrier admission errors. Maximum carrier size: 9,708 bytes against the 10,000-byte limit.

This PR is a draft because validation remains failing:

• The existing TestMergeWorktree::test_merge_worktree_merges_on_green[implementation] hits recipe_segment_post_effect_delivery_failure. Implementation stopped at the verified plan's explicit budget stop condition; the bound and closure rule are preserved.
• The new closure-completeness invariant fails for both recipes because its literal-name assertion rejects a legitimate finalized step named done.

Refs #5286. The mixed I4 entry-hint observation was added to #4482's issue body. Full commissioning remains due after integration, with the review and strict-cleanup gates intact.