fix(prebind): reject contradictory boundary and execution outcomes

[tcconnally]

Problem

The current main branch validates the prebind block and AAR fields independently, but does not enforce coherence between them. plutus_agent/prebind.py:69-102 validates boundary_outcome and non_effective_result; plutus_agent/metering.py:230-249 validates AAR provenance/status; persistence stores both projections. There is no cross-check between a prebind result and terminal action_status or resource usage.

A live-main probe accepted one event containing a prebind with boundary_outcome="hold" and non_effective_result="not_executed" together with action_status="executed" and nonzero token/cost fields. The resulting receipt can simultaneously say that the action was held/non-effective and executed.

This is a regression/incomplete acceptance boundary against #197/#198: it weakens any null-effect or pre-action assurance claim.

Proposed change

Define and enforce a versioned state-transition truth table linking prebind boundary outcomes, non-effective results, terminal action status, and resource/cost fields. Reject contradictory same-event combinations, or require an explicit later execution/replay/correction reference when a held prebind is followed by a distinct action.

Acceptance criteria

• Hold/deny/abstain/interrupt/recover with non-effective results cannot be recorded in the same event as action_status="executed".
• Nonzero execution resource fields require a compatible terminal status and an explicit binding to the admitted action.
• Valid allow/executed and failed/cancelled/held combinations remain representable.
• The rule is enforced through both direct and HTTP ingestion.
• Tests cover hold, deny, abstain, interrupt, recover, executed, failed, cancelled, retry, and explicit later replay/correction cases.
• Receipts remain hash-covered and contain no raw sensitive payloads.

Grounding

• Current source: plutus_agent/prebind.py:69-102, plutus_agent/metering.py:230-249,472-485 at main commit 1a7be9a37116d9b8225b787992d38e7de0435c6.
• Reproduction: live-main probe accepted hold/not_executed with action_status=executed and nonzero cost/tokens.
• Related contract: ledger#197, ledger#198.
• Research leads: Atlas governed-write-gateway and append-only-memory-audit.

Non-goals

• No claim of universal safety; this is a receipt-state coherence contract.
• No raw prompts, context, tool arguments, credentials, or secrets.