Advance cleanup verification on newer same-epoch evidence

[davidabuch]

Physical commissioning of v0.11.49 showed that active cleanup reobservation acquired fresh post-boundary evidence, but the automatic runtime still waited because duplicate semantic epoch identities were dropped.

Observed:

• source cleanup accepted;
• fresh native source/body evidence arrived quickly;
• cleanup provenance refresh produced post-boundary topology within ~2 seconds;
• automatic execution did not immediately consume that evidence because both the HA runtime bridge and ThermalAutomaticExecutionDriver rejected frames whose semantic epoch_identity matched the prior frame;
• Pool OFF therefore still waited for a later policy/reconciliation epoch.

Fix:

• retain ordinary duplicate-epoch suppression;
• allow only strictly newer same-epoch observations while bounded termination/cleanup verification is active (termination_attempt, cleanup_provenance, or cleanup_attempt);
• same-epoch verification frames do not open a new physical-authority epoch;
• when newer evidence arrives while a driver task is still in flight, replay that newest frame after task completion;
• driver-level duplicate guard applies the same restriction, so newer evidence can verify accepted consequences without admitting general same-epoch reevaluation;
• older/equal timestamps remain idempotently ignored.

Regressions:

• steady-state same epoch remains ignored;
• newer same-epoch cleanup evidence resubmits without a second authority epoch;
• same-epoch evidence arriving while a task is in flight is replayed afterward;
• newer same-epoch source-Off evidence verifies an accepted termination consequence.