fix: publish corrected state-D setup bundle

[sftimeless]

Summary

• export the merged state-D setup continuity and bounded verification helper from keel-skills
• persist ignored local invocation state atomically and fail closed on persistence failure
• match the current /v1/execute request contract, retain only validated non-secret correlation IDs, and bound response handling
• pin the exact reviewed and merged skills/API provenance plus the merged OpenAPI digest

Action Mapping state F, mapping authority, credentials, WebAuthn enrollment, and recovery remain excluded and hard-off.

Provenance

• keel-skills approved source: ef6b92880f0729c336b3fad85e256135c91968da
• keel-skills merge: 165c5f308bb339d8024f9fb1d66956e0940db2e7
• keel-api approved source: 4ce5f5def6258004861dfaeeef512e49afc87cfd
• keel-api merge: c130f73d966fce6572aa5dc8ff48164b9e9dbf15
• merged OpenAPI SHA-256: 40f9b7ef1ad7ab38409c6b97d36ec654afc94a40f98475b6cda06b331b355db9
• UnifiedExecuteRequest schema SHA-256 remains 67beb5283aa68267eeaaa52bfcc4e7d799fe61d5e9f194445e8230de44478213

All 27 exported skills-derived files are byte-identical to the merged skills tree.

Verification

• release allowlist and SHA256SUMS: pass
• unified execute contract, including merged OpenAPI comparison: pass
• keel-setup: 58 passed
• keel-policy: 10 passed
• shared: 15 passed
• helper drift and source-provenance mutations: refused
• changed-file Ruff and git diff --check: pass

No tag, release, package publication, deployment, activation, registration change, credential operation, or production interaction.