Load checked installations independently of the running compiler (WI-16)

Keep compiler-dependent checks in Nix builds; load stored plans and programs with original provenance and runtime artifact validation. Allow an identical executable world to receive a new activation epoch after a toolchain rebuild.

Compiler-update/altered-program regression, coordinator and full sandboxed integration checks pass; lint and formatting pass. Default platform/source wiring remains the next task.

test/presentations.test.ts

@@ -17,7 +17,7 @@ import {
   componentArtifactDigest,
   componentSharedModules,
   expectedArtifactReceipt,
-  loadExecutionInstallation,
+  checkExecutionInstallation,
   clientContractCatalog,
   type ComponentArtifact,
   type PackageArtifacts,
@@ -208,7 +208,7 @@ test("checked component-only artifacts install without a service and reject miss
       await writeFile(path.join(root, file), content);
     }
     await writeFile(path.join(root, "share/quixos/build-receipt.json"), JSON.stringify(receipt));
-    const installation = await loadExecutionInstallation(plan, { [pkg.revision]: root }, generator);
+    const installation = await checkExecutionInstallation(plan, { [pkg.revision]: root }, generator);
     assert.equal(installation.packages[0]!.service, undefined);
     assert.equal(installation.components[0]!.id, "component:card");
     assert.ok(installation.routes[installation.components[0]!.url]);