fix(dlv): the advertisement's vault post is a frozen artifact, not a DLVManager derivation

[cryptskii]

Problem (owner cleanup step 3 — the restart recovery gap)

route.publishRoutingAdvertisement derived its full VaultPostProto mirror from dlv_manager.create_vault_post. DLVManager vaults are process-lifetime by doctrine (no repopulation from records — that would fabricate values nobody computed), so any restart permanently orphaned every existing vault for advertisement purposes — observed on hardware during the two-device e2e ("Vault not found", vault A8PSGQGZ…, chip task_3deb28ee).

Fix — durable replay, not rehydration

• dlv.create freezes the exact encoded post bytes onto the vault's record: new amm_vault_records.vault_post_proto column, joining the frozen baseline_state_ccb/baseline_presentation bytes (third instance of the repo's frozen-artifact pattern).
• The producer runs after finalize_vault applies the creator signature and enforcement + policy_digest are stamped — the earliest point the bytes are final — and is mandatory: a vault whose post cannot be frozen fails at creation, not at first publish.
• The publisher loads the record once (it already needed it for the presentation digest) and replays the frozen bytes when the caller passes empty; non-empty caller bytes (router-service integrations) are honoured verbatim as before. The DLVManager derive block is deleted, not gated — the handler no longer touches the manager at all, and an empty column fails closed with an error naming the missing producer.
• Trader-side sufficiency verified from source: route.syncVaultsForPair already rebuilds the full LimboVault from published post bytes (VaultPost::try_from → from_vault_post). Reconcile and dlv.composeVault are durable-only, so the ad path was the only owner-restart consumer.
• CLIENT_DB_SCHEMA_VERSION 6 → 7; beta does not migrate (clean wipe, devices re-onboard).

Regressions

• the_advertisement_publishes_from_durable_state_after_a_restart — a fresh router (empty DLVManager over the same durable state, head carried over as the persistence codec would) publishes the ad; also pins that the frozen bytes decode as a VaultPostProto naming the vault and carrying the LimboVaultProto.
• an_empty_frozen_post_refuses_to_publish_instead_of_rederiving — mutation control blanks the column in SQL (the exact pre-cut database state) and requires the refusal to name the missing producer.

Verification

• cargo test -p dsm_sdk --lib: 1772 passed / 0 failed (7 ignored)
• cargo check -p dsm_sdk --all-targets clean; make lint green (fmt + clippy + frontend)
• Next: owner step 4 — the restart-in-the-middle two-phone run (fresh APK required: schema v7 wipes device state)