Use invocation identity for persistent-worker lifecycle resume

[chubes4]

Summary

• replace PID-based lifecycle freshness with explicit server-owned validation invocation identities
• persist the prepare invocation in the existing lifecycle receipt and compare it with the resume invocation
• preserve rejection of a genuine same-invocation resume while allowing distinct commands in one persistent PHP worker
• add deterministic persistent-worker and same-invocation coverage

Fixes #866.

Verification

• homeboy review --placement local --path /Users/chubes/Developer/static-site-importer@fix-866-lifecycle-invocation-identity --changed-since origin/main --summary
• npm run test:fixture-matrix (259 passing)
• npm test (50 manifest tests passing)
• focused lifecycle smoke tests (168 assertions passing)

Fixture 87 passed through the real host-staged WP Codebox path:

node tools/run-fixture-matrix.mjs \
  --local \
  --static-site-importer /Users/chubes/Developer/static-site-importer@fix-866-lifecycle-invocation-identity \
  --blocks-engine /Users/chubes/Developer/blocks-engine \
  --target-fixture 87-travel-tours \
  --artifact-root /tmp/ssi-866-fixture87-proof \
  --run-id ssi-866-fixture87-proof \
  --batch-size 1 \
  --concurrency 1 \
  --no-visual-parity

Homeboy run 20584cec-a1c1-4259-89d7-540fc6774998: 1/1 fixture passed, zero findings, zero gate failures. This advances the same runtime that previously stopped at static_site_importer_fresh_runtime_required through materialization and front-page editor validation.

AI assistance

OpenAI GPT-5.6 Sol via OpenCode and Homeboy implemented the invocation identity contract, added persistent-worker coverage, ran deterministic review gates, and verified fixture 87 in WP Codebox. Chris Huber directed the architecture and remains responsible for every line.