fix(bayn): bind research continuation to current build

[gregkonush]

Summary

• Repair the live post-fix(bayn): rotate native execution controller #13868 initialization failure by replacing only the sealed capital-activation-request payload with Bayn's canonical bayn.paper-research-build-continuation.v1 envelope.
• Bind that continuation to the already-active durable research generation c6dab85a27f4d5430e89aa460c385f054403dfe169c0d6ccc67950797c3a2240 and the reviewed b23c build/image, without rearming or creating capital authority.
• Rehash and serialize the controller rotation because the native plan hashes the configured activation payload: active d6342128.../b23c... -> continuation plan 2f3e78f5.../b23c..., activation generation cd73547c....
• Preserve account/key/secret ciphertext byte-for-byte; only the encrypted activation payload changes. Rollout remains GitOps-only.

Related Issues

N/A

Incident evidence

• fix(bayn): rotate native execution controller #13868 activation succeeded exactly: previous plan 989a0fd2.../954ee... was deactivated and d6342128.../b23c... was activated.
• The first preserved durable tick, sequence 7666, then failed native runtime initialization and exhausted its bounded retry budget.
• Root cause: the research request itself remained cryptographically bound to the old 954ee... build. capitalActivationRequestIsCurrent therefore correctly rejected it on b23c.
• Live durable authority was inspected read-only and remains the existing research generation c6dab85a..., effective/maximum research execution authority with kill clear; the failed initialization performed no broker mutation.

Immutable continuation evidence

• Existing request bytes were recovered without printing plaintext and validated with current Bayn schemas.
• Continuation was constructed using makeResearchCapitalBuildContinuation and round-tripped through decodeCapitalActivationConfigurationResult.
• Continuation hash: c2b802859f4d061c2659ef8f1e8e0e14f561541eda357f5bb42ba0597b32b16a.
• Serialized continuation SHA-256: 3a6a2aa0f1f435971121e5a483bb5fa552eca16ec9abba68ee595a75a3b3d075.
• Recomputed native controller plan: 2f3e78f5cb4cfc51c2853de158b22d67cff65dfb16a94defe178583805ebf347.
• Recomputed activation generation: cd73547c3864c37dce050d01f55a30fb07985888b1964ddc8412cc36d8c0df20.
• Sealed with kubeseal 0.38.4, matching the live Sealed Secrets controller; kubeseal --validate succeeds.

Testing

• bun test services/bayn/src/composition.test.ts -t 'resumes' — 2 passed, 0 failed.
• bun test packages/scripts/src/bayn packages/scripts/src/shared/__tests__/bayn-cnpg-contract.test.ts — 141 passed, 0 failed.
• bun run --cwd packages/scripts lint:oxlint:type — 0 errors; existing unrelated warnings only.
• kubectl kustomize argocd/applications/bayn — renders the continuation plan, exact previous binding, new activation generation, and unique Sync hook.
• kubeseal --validate --controller-name sealed-secrets --controller-namespace sealed-secrets — success.
• git diff --check.
• Repository pre-commit lint-staged and commit-message hooks — success.

Breaking Changes

None. This is a serialized recovery of the existing bounded research execution generation onto the already-reviewed current build. No broker credentials, trading logic, account identity, risk policy, persistence schema, or capital grant are changed.

Checklist

• Testing section documents the exact validation performed.
• Only the encrypted activation payload changes; broker credential ciphertext remains unchanged.
• The new controller plan is bound to the exact currently active d634/b23c controller generation.
• No direct Argo sync, deployment, Secret mutation, or broker mutation was performed.

[gregkonush]

Superseded by #13870, which landed the build continuation for the active research generation; subsequent #13871/#13874/#13877/#13882/#13884 hardened atomic activation, deployment binding, lazy writer fencing, durable successor proof, and immutable image rotation. Current production is Synced/Healthy on current main with advancing native Restate ticks and repeated EXACT reconciliation, so rebasing this stale conflicting PR would reintroduce obsolete bindings.