fix: prevent legacy fanout and canonicalize policy aliases

[RyshMan]

Summary

• follow up on wave1: agent inventory identity and policy compatibility #86
• implement lifecycle migration guard from wave1: agent inventory identity and policy compatibility #86 (comment)
  • allow only one successor AgentID to inherit a legacy identity's prior state/approval during LegacyAgentID migration
  • additional split identities are treated as newly discovered and require review
• implement policy alias canonicalization from wave1: agent inventory identity and policy compatibility #86 (comment)
  • canonicalize WRKR-A### and WRKR-### to a single family ID before persistence/merge
  • add deterministic tests proving alias override collapses to one canonical rule

Validation

• go test ./core/lifecycle ./core/policy -count=1
• make lint-fast
• make test-fast
• make prepush-full
• ./.tmp/wrkr scan -path . --json
• ./.tmp/wrkr verify --chain --json
• ./.tmp/wrkr regress run --baseline /tmp/pr86-scan.json --json (exit 5: drift, expected for this baseline in local repo state)