fix: add read-side supersession for sealed-head bindings

[chtnnh]

Closes #3

Summary

Adds read-side defense in depth for stale sealed-head artifacts. When a newer pass has no sealed tip of its own, it supersedes an older range seal or standalone binding so restored or legacy artifacts cannot keep an already-superseded tip pinned.

Trust and safety

• Read-side logic changes only which artifact is trusted; it never deletes artifacts.
• With attestation enabled, only a newer human-signed, unbound gate can supersede a signed binding.
• Unsigned or tampered newer gates cannot remove a trusted binding.
• Missing, invalid, equal, or older timestamps fail closed.
• Gates that carry their own sealedHeadOid remain authoritative.

Coverage

• Stale range-seal supersession after a newer unbound pass.
• Signed standalone-binding supersession.
• Unsigned newer gates cannot supersede trusted standalone bindings.
• Existing forged-seal and active-tip preservation coverage remains green.

Verification

• npm run lint
• npm run build
• node --test packages/cli/dist/range-seal-bind.test.js
• npm test
• Correctness review: clean after the signed-binding regression.
• Security review: clean; verified signature, timestamp, and fail-closed behavior.

[cursor]

PR Summary

Medium Risk
Changes which sealed-head artifacts are trusted in enforcement (headMatchesRangeSeal); mitigated by timestamp checks, gates with their own sealed tip staying authoritative, and attestation-required signature checks before superseding signed bindings.

Overview
Adds read-side supersession so a newer gate pass that does not carry its own sealedHeadOid no longer trusts stale range-seal or standalone sealed-head-binding artifacts when resolving the bound tip.

sealedHeadBinding now consults newerGateSupersedesSeal: the current gate must have a later passedAt than the seal’s sealedAt or binding’s boundAt, must not include sealedHeadOid, and when requireAttest is on the gate must verify as signed—otherwise the old binding stays in effect. When superseded, those sources are skipped (binding resolves to null from them), so headMatchesRangeSeal can allow shipping again without deleting files on disk.

New tests cover stale range-seal after a newer unbound pass, signed standalone binding cleared only by a newer signed unbound gate, and unsigned newer gates failing to lift a trusted binding.

^{Reviewed by Cursor Bugbot for commit ae07034. Bugbot is set up for automated code reviews on this repo. Configure here.}