Adopt authority-safe checked mdbase APIs

[callumalpass]

Summary

• adopt checked canonical outcomes, explicit bounded capture contexts, and resolver projection v6
• consume typed hosted/local outcomes without legacy mutation feature activation
• preserve authorization, durable runtime claims, provider authority, and exact v0.3 wire adaptation
• advance deployment pin to mdbase-rs 3c1bbbcf08f4d4cd86cc869c7bad03c17cc03f54

Stack

Stacks on #358. Requires the paired mdbase-rs Phase 5 PR.

Qualification

• Rust package tests, strict type/lint checks, architecture and feature-graph guards
• Node 24 package tests/typecheck
• typed wire-boundary and hosted/local outcome regressions
• deployment pin verification
• independent hostile review: ACCEPT