[Tristan-Stoltz-ERC]

Summary

Stacked on #2874. Adds an in-process reference controller-sink wrapper that requires a controller epoch on every submission and distinguishes command admission from later outcome ingestion.

Implementation

• Adds EpochFencedControllerSink<S>, which deliberately does not implement the untagged ControllerSink trait; callers must name the generation for each submission.
• Compares the provided generation to the active generation before calling the wrapped sink; stale generation is rejected with zero wrapped-sink calls.
• Returns EpochFencedControllerReceipt carrying both the epoch and native controller receipt, so the epoch remains part of the effective ticket/request identity.
• Only accepts strictly increasing epoch activation.
• Adds six focused mock tests: current-epoch receipt binding, zero calls for stale epochs, native ticket reuse across generations, backward/same-epoch rejection, controller error propagation, and mutex-owned serialization around epoch change/submission.
• Adds docs/research/ROBOTICS_EPOCH_FENCED_COMMAND_ADMISSION_V0_1.md documenting the in-process scope and the production atomic-admission requirement.
• Extends the recovery scorer with stale_epoch_command_admission_acceptances, kept separate from stale outcome-event acceptance and included in the hard-gate violation total.
• Extends the benchmark protocol and machine-readable scenario manifest with command-epoch, application-epoch, sink-call-count, and old-queue policy evidence.
• Extends the CI branch allowlist for this stacked branch.

Critical limits

This is an in-process reference fence, not a production hardware or IPC admission implementation. The caller must hold one owner/mutex around generation advancement and submission. It does not consult the persistent authority on every call, prevent another process from bypassing the wrapper, or cancel commands already accepted in an older generation. A real native sink must enforce the epoch at its atomic command-acceptance/application boundary; hardware watchdog/e-stop/safe-state logic remains independent.

Validation

• Exact PR head: ff5f8ae
• Exact-head CI run: https://github.com/Luminous-Dynamics/symtropy/actions/runs/40922508359 (queued, not passed).
• Source/manifest structure and the 660-scenario / 2,640 arm-record expansion were checked author-time.
• The six new sink tests and 12 scorer tests are authored but have not been run locally because this environment has no Cargo/Rust/rustfmt toolchain.
• Exact-head CI is required before claiming tests passed; queued is not passed.
• No physical-safety, durable anti-replay, or SOTA-performance claim is made.

Related: #2828, #2836, #2852, #2860, #2862, #2868, #2874.