fix(tangle): preserve selected native credentials on turns

[drewstone]

Cause

The retained H cloud turn had only authMode in backend.model, despite a selected stored subscription reference at boot.
Its native evidence recorded no materialized credential paths and Claude refused login.
The shared Provider sent the reference at creation but omitted it from new turn transport.

Correction

• Carry the exact selected public native reference on new streams, detached dispatches, and session prompts before request digest calculation.
• Preserve model, profile, tools, runtime attachments, and the exact account/harness selection.
• Restore cold bindings from persisted metadata and the observed backend.
• Refuse account, harness, and credential channel changes before dispatch.
• Keep cursor and event-zero exact replay byte/digest identical to its admitted request.

The Provider does not read credential values, alter native credential files, renew subscriptions, or add a Lab shim.

Verification

• 77 focused consumer and retained-control checks pass.
• Full Provider suite: 505/505 pass.
• Workspace build, typechecks, and tests pass.
• Isolated artifact gate: nine packages, 33 exports, and 66 targets pass.
• Packed control contract gate passes.
• Real SDK HTTP create/turn/cold-recovery consumer runs on Sandbox 0.58.7.
• Root independently reviewed exact source commit 2fc00b1560e73922c7b46ed8e14731c1c387afb2; no blocking boundary finding.

H-shaped regressions cover roots, recursive children, streams, session prompts, detached admission digests, cold recovery, substitution refusals, and both replay forms.
The existing HTTP recovery fixture now mocks the actual SDK /backend route.

Provenance and rollout

Retained engineering and source proof: /mnt/traces/provider-native-auth-turn-binding-20261001/receipt.json.
The checked unpublished source archive is frozen independently from registry 3.1.1.
The canonical cloud launch owner adopts that exact artifact through the existing immutable controller build while normal publishing proceeds.
Authenticated research execution remains a separate live check owned by the cloud operator.
No historical input or prior failed execution is rewritten.

[tangletools]

✅ Auto-approved PR — 2fc00b15

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-01T06:16:38Z}