fleet: check native source reader successor policy

[forhappy]

What changes

Continue the fleet implementation plan after merged PR #37.

• Compose exact retained native source reader retirement with an actual managed writer successor, canonical final-root/origin verification, current reader policy and actual ready replacement requests.
• Reuse the existing managed-writer validator and current reader confirmation loop; no scheduler, authority, durability or admission path is added.
• Retain source checks through the original observation barrier and full original/current maintenance matcher. Missing evidence remains SourceSuccessor; exact checked source readers become SourceReader.
• Bind provider allocation/presence, full head/registry/roster, signed boots, native writer rows, clock/deadline bounds and original capture in planner identity v12.
• Add the source-reader recipe and 11 real native minion cases. crates/cellule-host/minion remains canonical.

Persisted enrollment/evacuation and signed peer formats are unchanged. This point collection grants no retention pin, complete-observation upgrade or SettleRoles/Finalize rights.

Verification

Frozen Rust 1.99 source passes all 13 qualification commands and nine static gates:

• Framework: 1,711 passes, zero failures, 37 documented ignores.
• Minion: 331 passes, zero failures. Framework/minion total: 2,042 distinct passes; focused repeats and overlapping local LTX are excluded.
• Local LTX: 54; Axum without default features: 16; cookbook: 256 plus check, Clippy, warning-denied docs and binary builds.
• Workspace all features/targets, warning-denied Clippy/API docs, and minion build pass.
• All 137 Rust snippets parse; 1,307 local Markdown links resolve.
• The one-variable negative control substitutes the original opening root for the final joined root; the exact-prefix regression fails as intended. Production source is restored byte-identically before publication.

The native cases exercise refreshed final roots, actual writer drain/restoration, exact original closure, a new reader request on the same Active receiver, independent SQLite clients, public reconciliation, missing/changed evidence, foreign origins/physical mappings, clock/deadline/cancellation, original source errors and changes behind actual signed native replies. Successful fixtures join all native owners and check released ledgers. Initial compile/setup and negative-control type failures are retained and excluded from qualification claims.

All 1,133 Rust/Cargo paths are pinned in the retained source manifest. Source, commands/results, manifests and original failures are under /Users/haipingfu/Workspace/crabbuild-target/cellule-source-reader-9110095/evidence.

Remaining full plan scope

The full W1–W10 objective remains active. Complete durable provider/process retention and failed-owner reader/follower succession; native/external accepted-work and unknown-outcome coverage; SettleRoles/Finalize through original action joining, native Stopped, withdrawal, retired boots and committed completion; Cron/Blob owners and primitive fault matrices; receiver-session recovery/adoption and sustained convergence; minion maintenance/receiver-loss commands; W9 process/provider/mixed-binary/load campaigns; W10 exercised runbooks and rollout/rollback.

PR #37 was merged as fa548bb during qualification. Its tree is byte-identical to baseline 9110095; this follow-up is based directly on that main. Current follow-up CI and routing campaigns remain required. Earlier intermittent follower-observation/overload failures are retained; later passes do not independently establish their causes.