fix: make rewrite range sealing scoped and failure-atomic

[chtnnh]

Problem

Rewrite sealing currently selects history with broad DAG traversal and rewrites before proving the signer can complete the seal. Merge-heavy branches can therefore rewrite more history than intended, and a later signing failure leaves mutated history without a seal.

Scope

Define the exact feature-commit set for rewrite sealing and make the operation preflighted and recoverable.

Acceptance criteria

• Rewrite selection excludes commits reachable from the current base unless explicitly intended.
• The signer and all deterministic inputs are validated before history mutation.
• Failure after a rewrite has a narrow, documented rollback/recovery path.
• Cleanup never removes unrelated recovery refs.
• Tests cover merged-base history, signing failure, and unrelated refs/original/* refs.