feat(addie): seal request tool replay bindings

[bokelley]

Summary

• rebased on main at ddba2ff26f29ab8f9d856045c3a635befc97727e (including merged fix(addie): enforce common fixed-trace tool universe #7302) and reuses refactor(addie): extract neutral request tool assembly #7299 request-local assembly
• adds an in-memory, one-use, handler-free integrity binding for ordered production-parity definition/handler intersections
• exposes frozen simulator descriptors only; no trusted production boundary, dispatch, provider, or direct fixed-trace admission is introduced

Integrity repairs

• module-private monotonic TTL with future-fact wall-clock validation; wall-clock rollback cannot extend lifetime
• deeply snapshots semantic tool definitions and validates all handler slots, source drift, wrapper shape, and proxy/accessor rejection
• capture and claim wrappers are exact own-data snapshots; authentic bindings are terminally consumed before signal validation so malformed signals cannot preserve reuse
• projection copies, brands, prototype changes, hashes, and serialization remain non-valid; public result uses integrity-only valid terminology

Validation

• npx vitest run server/tests/unit/addie/request-tool-replay-binding.test.ts --pool forks --maxWorkers 1 --no-file-parallelism — 22 passed
• assembly/replay/direct focused command (11 files: binding, assembly, wire shape, replay policy, direct Slack, providers, shadow cohort/replay/pricing, runner) — 234 passed
• official/replay extension command (9 shadow replay/evaluator files) — 140 passed
• npx vitest run server/tests/unit/addie/fixed-trace-suite.test.ts --pool forks --maxWorkers 1 --no-file-parallelism --testTimeout 60000 — 62 passed
• npm run validate:addie-fixed-traces — 82-case corpus metadata passed
• npm run typecheck; reference/inventory freshness (249 tools, 67 sets); inventory portability; npm run test:platform-agnostic (980 schemas); git diff --check — passed

Scope

This draft remains non-dispatching and non-authoritative: no production call site, real handler execution/export, provider client, credential access, rollout, or fixed-trace direct admission. Synthetic facts are not authenticated. Draft #7292 has no file overlap.

[aao-secretariat]

Ladon verdict: Approve

Approve

Adds request-tool-replay-binding.ts (710 lines) — a non-dispatching, in-memory, one-use integrity binding over #7299's request-local tool assembly — plus a 499-line adversarial test, a build script, and a generated tool-surface inventory JSON. No protocol/schema/wire surface touched (static/schemas/source/**, docs/reference/**, dist/** untouched), so no changeset is required and no schema↔docs coherence or oneOf audit concerns apply. No production wiring — no consumer imports it.

Checks performed by the reviewer and confirmed clean: assembly-drift re-validation, terminal fail-closed consumption ordering, monotonic TTL vs wall-clock rollback, full fact binding, and WeakMap forgery resistance. No Critical/High/Medium findings.

Decision path: no critical/high (row 1 n/a); gated_paths false (row 2 n/a); high_risk is true but the only reasons are (added) and (modified) with no findings — no (deleted) (row 3 n/a), no medium finding to trigger rows 4/5; no prior decision (row 6 n/a); no no-auto-approve team match (row 7 n/a); zero medium findings (row 8 n/a). Falls through to row 9 → approve. The high_risk flag on new/modified addie files is scaffolding-normal with no evidence of risk.