fix(loop): resume historical active targets

[codeacme17]

Summary

• let the installed activation router select historical-target compatibility only when a durable active issue run is present
• keep full control-plane validation for normal dev activation
• reject caller-supplied compatibility mode
• retain stable target-state, owner-channel, JSON-history, and low-privilege workflow checks

Problem

PR #111 is a durable active run at c510050, created before the trusted runtime added review-publication.mjs, publish-review.mjs, and newer evidence-workflow invariants. The installed e85f9b3 control plane therefore rejects its clean exact-head worktree before restore-checkpoint, leaving Traviinam findings without an Ethandasw response cycle.

The issue branch cannot safely absorb control-plane files: protected-diff and product-boundary rules correctly require those changes to arrive through an owner-reviewed bootstrap PR.

Security boundaries

• the complete installed bundle remains manifest/hash verified
• both isolated GitHub profiles are still probed by wrapped activation
• compatibility is selected internally only when the trusted router observes a durable active issue run
• direct --target-compatibility requests are rejected
• historical workflows must remain low-privilege pull_request workflows with read-only contents permission and no pull_request_target
• restore-checkpoint still requires the journal-bound clean branch and exact head

Verification

• node --test loops/issue-dev-loop/tests/*.test.mjs: 95 passed
• pnpm loop:issue-dev:validate: passed, 67 checked files
• pnpm lint: passed
• real PR docs: close remaining Island UI and content parity gaps #111 target validation: passed, 24 checked files

Constraints

This PR must remain Draft. Do not mark Ready, Approve, or Merge through automation. The owner will merge manually after review.