t27b lab: a request run overwrites /ddc/latest.receipt.json with a branch commit's DDC receipt #7955

Part of #6488 (C4 evidence) and #6063.

What happens. contrib/railway/t27b-lab/lab.py runs the DDC step (#7699, #7706) for every lab run, including the PR-head request runs from #7686. On each of those it writes /ddc/latest.receipt.json, and it judges ddc-receipt due against that same file.

Observed on 2026-10-09. /ddc/latest.receipt.json named d659b89, a lane branch head that predates #7931 and #7950. It carried that branch's older S (261f436a...), although the master run 577c02b had signed its own receipt (/ddc/577c02bd9...receipt.json, DDC_BACKEND_AGREEMENT).

Effect. The receipts themselves are honest. But "latest" can name a non-master commit, and master's next due check is judged against a branch.

Fix. /ddc/latest.receipt.json is written by master runs only, as /latest.json already is. A request run still signs and publishes /ddc/<sha>.receipt.json. verify reads the run's own <sha> receipt.

User Scenarios

• Given a PR-head request run executes the DDC step in the t27b lab, When the run completes, Then /ddc/latest.receipt.json is not overwritten and still reflects the most recent master run's receipt.
• Given a master run executes the DDC step in the t27b lab, When the run completes, Then /ddc/latest.receipt.json is updated to that master run's receipt (matching the behavior of /latest.json).
• Given a request run produces its own DDC receipt at /ddc/<sha>.receipt.json, When verify runs for that request, Then it reads /ddc/<sha>.receipt.json rather than /ddc/latest.receipt.json.

Requirements

• FR-001: The t27b lab MUST write /ddc/latest.receipt.json only on master runs, not on request runs.
• FR-002: Request runs MUST still write their per-commit receipt to /ddc/<sha>.receipt.json.
• FR-003: The verify step MUST read the run's own per-commit receipt (/ddc/<sha>.receipt.json) instead of /ddc/latest.receipt.json.
• FR-004: The behavior MUST mirror how /latest.json is already handled (master-only writes).

Success Criteria

• contrib/railway/t27b-lab/lab.py exits 0 on both master and request runs without overwriting /ddc/latest.receipt.json on request runs.
• scripts/verify.sh exits 0 when run against a request run, reading /ddc/<sha>.receipt.json.
• 5 tests in the lab suite pass, covering master write, request non-write, request per-commit write, verify reads correct receipt, and latest.receipt.json matches latest master.

Boundary

• contrib/railway/t27b-lab/lab.py
• scripts/verify.sh
• specs/verified/receipt.t27