Repair file-copy workflow finality and governed recovery

[witbrock]

What changed

• repair the represented file-copy interpretation workflow so its launch contract requires only file_copy_concept_id and both workflow steps map that context value to the underlying concept_id tool argument
• publish the corrected contract in canonical workflow seed 50
• attach an exact upsert_scoped_assertion recovery action to governed canonical-write denials
• reconcile known-no-change not_started denials only after an exact successful scoped recovery
• verify scoped assertion read-back against subject, predicate, object and language, actor, organisation, namespace, singleton audience, status, provenance and non-publication
• preserve the useful verified answer when failed represented-workflow attempts coexist with canonically read-back scoped results
• align adaptive-turn fixtures with the current ontology-governance boundary

Root cause

The file-copy workflow publication required both legacy concept_id and file_copy_concept_id context keys even though the invoked tools accept one concept identifier. The workflow therefore failed metadata validation before executing. In the recovery path, governed denials were recorded as not_started, but their generic recovery hint did not carry exact executable arguments and finality could not prove that the later scoped write recovered the denied semantic effect.

Impact

A durable file copy can now launch the interpretation workflow with its single intended identifier. When canonical publication is correctly denied and an actor-scoped assertion succeeds, the turn reports the verified user outcome without misrepresenting the denied canonical mutation as successful.

Validation

• tests/backend/test_adaptive_turn_service.py: 162 passed
• workflow publication/discovery group: 156 passed
• ontology publication/creation authority: 18 passed
• internal MCP scoped-assertion authority: 13 passed
• file-copy interpretation service: 4 passed
• JSON validation, seed-version guard and git diff --check: passed

Known baseline limitation

Three scoped-assertion listing tests fail under VON_USE_MOCK_DB=1 because their visibility fixtures do not populate or stub the concept visibility batch. The exact failures reproduce on origin/main and this branch does not modify that service or those tests.