Accept blocked external operation receipts

[areshand]

Summary

• treat terminal blocked ops receipts as consistently classified non-successful operations
• allow external-only workflows with earlier successful evidence to return a partial caller result instead of retrying indefinitely
• route the existing clarification completion modes through the typed supervisor authority channel, restricted to the orchestrator UID
• cover receipt classification and authority routing in lifecycle and unit tests

Production UX evidence

A real request for the latest open PR successfully fetched the PR, then received a terminal blocked/blocked receipt when CI status was unavailable. The completion gate incorrectly rejected that valid receipt as mismatched, so the client never received the partial result. A separate clarification attempt bypassed the supervisor authority channel and was rejected by the lifecycle gate.

Security boundary

Clarification routes retain their existing validation and completion behavior. The change only allows the supervisor to execute them after typed socket authorization; callers remain restricted to the orchestrator UID and gain no repository or ops write authority.

Validation

• cargo fmt --check
• cargo test authority::tests
• cargo build
• bash tests/lifecycle.sh