feat(runtime): close the wiring gaps between interfaces and pipelines

Several contracts existed and were tested in isolation while nothing actually
used them. Reported as complete previously; this corrects that.

- storage was injected and never referenced. Adds persist/hydrate, hydration
  before querying relays, and last-known-good state with a stale flag when a
  relay is unreachable, which is what makes the characterized cache-fallback
  behavior real rather than reduction-level only
- signature verification existed as a tested helper the load path never called.
  Now applied through an injected verifier before state becomes authoritative,
  with rejection counts and an enabled/disabled readout in diagnostics
- trusted mute lists had no subscription flow, so the store never populated in
  a real deployment. Subscribes by author, chunked
- community source references decoded but were never resolved. Curator lists
  are now fetched and merged with a source marker, still capability-checked
- root-published policy was announced and discarded. Now applied, accepted only
  from the root, and a malformed document leaves the working policy intact
- adds import/export and capability queries

Two design corrections found while wiring:
- the cache key hashed the entire roster, so it rotated whenever a moderator
  was added and the cache was discarded. Now derived from root identity alone.
- the root administrator is a constructor option: it is deployment config, and
  hydration could not otherwise find its own cache, since the key derives from
  the very fingerprint the cache would have supplied.

634 tests; lint, typecheck, and the declaration build clean.

packages/runtime/src/stores.js

@@ -90,9 +90,15 @@ export class GovernanceAdminStore extends Emitter {
     this.#recompute();
   }
 
-  /** The root-authority fingerprint, used to namespace cached state. */
+  /**
+   * The root-authority fingerprint, used to namespace cached state.
+   *
+   * Derived from the root identity alone, not the full roster: rotating the
+   * root administrator must invalidate the cache, but adding a moderator must
+   * not, or the cache would be discarded on every roster change.
+   */
   get rootFingerprint() {
-    return fingerprint({ root: this.authority.root ?? "", actors: this.authority.actors });
+    return fingerprint({ root: this.authority.root ?? "" });
   }
 
   #recompute() {