feat(runtime): bind compaction checkpoints to source coverage

[likun666661]

Summary

Phase 2C of #948 makes durable history Compaction checkpoints explicit projections over a validated source prefix.

• add a versioned runtime_event_projection cursor ledger for policy-owned ordered projections
• bind every newly built V2 checkpoint to the inclusive source range under maka.compactable_runtime_event_projection.v1
• validate session, boundary event ids, projection ordinals, event count, and the existing full-prefix digest before replay
• return successor Runtime Events from the prefix matcher and use that result in both replay and rolling Compaction
• preserve source-bound checkpoints against legacy downgrade during append, repair, and canonical-ledger recovery
• keep source-less legacy V2 checkpoints readable when no stronger source-bound checkpoint exists
• update the evidence-spine architecture document through Phase 2C

Invariants

• Compaction remains a lossy provider-visible projection; Runtime Events remain canonical facts
• projection cursors are not misrepresented as AgentRun append-log cursors
• cursor sequence is meaningful only within the adjacent versioned projection policy and session stream
• exact source mismatch fails closed before a checkpoint can replace raw history
• successor facts remain outside the compacted prefix and replay raw

Compatibility

The V2 durable shape remains backward compatible: source is optional only for records written before Phase 2C, while the current builder always writes it. Once a valid source-bound checkpoint exists, older binaries cannot silently move the bounded projection or recovery result back to an unbound legacy checkpoint.

Verification

• npm --workspace @maka/core test
• npm --workspace @maka/storage test
• npm --workspace @maka/runtime test
• npm run typecheck
• git diff --check

All passed locally.