Fix observable module-pin preconditions and failed-release identity

[rldyourmnd]

Changes

• Preserve stable finding codes when module-pin preconditions go stale, so the journal names the cause without storing raw provider diagnostics.
• Isolate declared module verification lanes from host Git configuration that can start background fsmonitor processes and produce false unjoined-descendant failures.
• Advance release identity past an already-tagged failed bundle. With failed 0.9.17/sequence 72, the next successful candidate is 0.9.18/sequence 73.

Verification

• go test ./core/app ./core/operations
• python3 -m pytest -q (70 passed, 9 subtests)
• scripts/validate_shell.sh
• Release resolver exercised against mocked successful and failed latest envelopes.
• go test ./... and scripts/validate_go_core.sh --quick are running locally; required CI will also prove them.