t27c silicon-queue and the reseal guard: wire silicon_queue.t27 (step 5 of #8095) #8147

Problem

specs/verified/silicon_queue.t27 (#8121) decides the bench queue and the reseal guard, but nothing calls it: t27c seal --save can still orphan a silicon run (it did on 2026-10-09, caught before merge), and no command lists what the boards should run. Step 5 of #8095.

Spec

specs/verified/silicon_queue.t27 (generated: bootstrap/gen/rust/verified/silicon_queue.rs) and seal_identity.t27 silicon_state; a run stands for the current seal by run_record.t27's own rule (receipt seal_hash == gen_hash_verilog, toolchain == built_by).

Tests

t27c silicon-queue prints none specs/fpga/ternary_link.t27 on master (R3-3 covers its seal) and queue when the seal's Verilog hash differs; t27c seal specs/fpga/ternary_link.t27 --save refuses without --force and writes nothing.

Acceptance

Both behaviours on master; hand glue within the foreign budget (main.rs +20, service.rs +24).

Boundary

• specs/fpga/ternary_link.t27
• specs/verified/silicon_queue.t27
• bootstrap/gen/rust/verified/silicon_queue.rs