feat(core): consume SemanticObservation proof in bind_current_nodes

[cursor]

Successor to #172 on exact prerequisite #127 head 65f51937ff2af64d9c157666e7c3b7df89cbb89a.

Buyer/security gap

#172 adds admit_query_nodes, but public bind_current_nodes still minted ObservedNodeHandle values from an untrusted locateNodes list without consuming the exact SemanticObservation protocol-use proof. Navigation-only and TypedInput-only callers could bypass the intended semantic-observation gate. admit_query_nodes also dropped the non-cloneable ValidatedBrowserProtocolUse instead of transferring it into binding.

Current exact implemented boundary

Current exact contributor head is 761d4be7ba6297e3c8078b947bd68cedafd56976; exact feature-base tip remains 65f51937ff2af64d9c157666e7c3b7df89cbb89a.

This lane now:

• consumes ValidatedBrowserProtocolUse by ownership in bind_current_nodes;
• accepts only SemanticObservation proof and rejects TypedInput/Navigation proofs;
• transfers the validated proof from admit_query_nodes into binding;
• keeps raw BrowserAuthorityRegistry::bind_node crate-private so external callers cannot bypass protocol admission;
• routes the legacy origin-binding integration test through the public semantic-observation admission path instead of reopening the raw minting API; and
• applies canonical rustfmt/test-fixture lint policy without weakening production linting.

TDD / repair sequence

1. Test-only c0e3d8e established the missing-production RED: bind_current_nodes must take a protocol-use proof and reject TypedInput and Navigation proofs.
2. d6a7998 implemented proof consumption and capability gating; d83fec0 formatted the original slice.
3. Exact CI later exposed two real integration regressions after raw node minting became crate-private: an external test still called bind_node, and another test file was not canonically formatted.
4. The origin-binding test was repaired to mint through the real public semantic-observation admission path; the exact rustfmt artifact was applied to the authority-registry test.
5. The next exact-head CI proved all workspace tests green but strict Clippy correctly rejected fixture-only expect() calls. The final repair added the repository-standard test-only #![allow(clippy::expect_used)] to that integration test rather than weakening the workspace gate.

Exact-current proof

On unchanged exact head 761d4be7ba6297e3c8078b947bd68cedafd56976:

• CI run 31969931127: success;
• Manifest V3 Compatibility run 31969931159: success;
• CI includes repository contracts, canonical rustfmt, locked workspace check, all workspace tests, strict Clippy, rustdoc, and exact production coverage enforcement;
• GitHub freshly reports the Draft mergeable; and
• no formal review is currently submitted on this exact head.

Feature-base organization workflows that did not execute on this exact head are not represented as passing. No predecessor-head check/review/status is transferred.

Truth boundary

This still does not serialize a BiDi command, authenticate Chromium, observe a live accessibility tree, authorize typed input, or prove a post-condition. The public handle-minting path in this slice is now protocol-admitted; a later trusted adapter must still sample the query result from a trusted transport and revalidate returned handles immediately before action.

Keep Draft while #127 and its prerequisite stack remain active. Prefer this branch over #172, #171, and #138 for QueryNodes admission. This scheduled actor does not merge, self-approve, alter workflows, add secrets, weaken checks, tag, or publish.