Handle Windows trustee aliases consistently across phase fences and authority receipts #110

The hosted Windows failures found while delivering #108 exposed literal numeric-SID checks against Windows SDDL aliases. The same pattern remains in the v1 and v4 phase-fence paths and the packaged phase-authority receipt validation:

• src/paper_pilot_phase_cutover.py: parent deny presence uses a literal numeric trustee.
• src/paper_pilot_phase_cutover_guarded_v4.py: copied file/parent/owner deny helpers use literal trustee comparisons.
• trace_gc/phase_authority.py: parent-fence receipt validation requires a literal (D;;LC;;;numeric-SID) substring.

Windows can serialize equivalent local administrator trustees as LA and built-in group trustees as aliases. The v2 investigation reproduces the representation mechanism on actual native Windows; the related paths require their own causal regression and qualification, rather than assuming the v2 test count establishes coverage.

Acceptance:

• Reproduce and repair trustee representation handling across the actual v1/v4 fence and packaged receipt-validation paths.
• Preserve exact permission masks, ACE types/flags/order, ownership, raw historical SDDL and digest pins, retry identity, fail-closed behavior and deny-open security assertions.
• Reject unrelated trustees including distinct account/domain SIDs sharing RID 500.
• Add genuine native Windows 3.12/3.13 positive and negative integration coverage, installed-package behavior where affected, source-manifest/archive checks and hosted CI coverage.
• Have actual Sonnet 5.5 implement and actual Astra independently review the exact signed final head before merge; verify post-merge checks.

Refs #90, #108, #109. Public guard repair does not reopen expired private windows or establish private pilot acceptance.