fix: reconcile active prepared replacement cutover (#242)

[James3014]

Closes the #242 control-plane gap reproduced during the live M5 HerdR cutover.

A coordination-bound cutover in PREPARED state already has exact current/expected identity, immutable carrier authority, and an approved finish pair. If an external bounded deployment replaces the process with the exact expected source/build/capability while the carrier is still valid, current main unnecessarily rejects terminal finish until expiry even though the same exact observed-replacement path is supported after expiry and in the legacy path.

This change permits only that exact active case:

• coordination-bound root controller remains authoritative;
• phase must be PREPARED with no drain/restart lineage;
• server instance must change;
• source/build/capability must exactly match the approved target;
• finish pair must exactly match the approved contract;
• positive workspace/agent reconciliation witness remains mandatory;
• normal drained flow and expired prepared recovery remain unchanged.

Verification on exact head 7d427d9:

• carrier-binding: 44/44 PASS, including new active prepared replacement witness and existing expired recovery/negative controls
• control-plane-consumer: 28/28 PASS
• typecheck PASS
• build PASS
• git diff --check PASS

Refs #242. Does not grant deployment/merge/acceptance authority.