Refuse rebound candidate roots

[bhyi4]

Summary

• reopen the host-allowlisted candidate root after each bounded read
• refuse delivery when the root pathname now identifies a different boundary
• document that the final identity recheck is not provenance or continuous monitoring

Validation

• candidate input: 8 tests
• shadow workflow: 13 tests
• isolated worker: 13 tests (4 privileged skips locally)
• wheel archive full harness
• isolated installed-wheel distribution contract (121.645s)
• pre-publish scan and publication gate

Compatibility

• no operating loader, permission, installation, or deployment changes
• keep yeoul-mcp at 0.4.0 and the deliberate mcp>=1.0.0,<2 SDK range