Run time consumes the catalog; retire string re-parsing at dispatch #586

Feature: #581 · Phase 4 of resource-construction.md.

The rule (design: 4-resource-management.md §5.6): no string-to-resource conversion ever happens at run time — at graph dispatch a string is a key, never a constructor. Dispatch resolves resource-typed slot values by identity against the run catalog (the clone of the now-complete graph catalog); a miss refuses; the buildCandidateAs prefix-strip retires. Products and discoveries are the sanctioned channels for resources that come into being at run time, and run-computed paths enter through the explicit file.discover/file.resolve actions (§5.7). Construction from strings survives only in load-time rehydration (an identity decode) and immediate mode.

Task issues, one per PR:

• Dispatch resolves by identity; a catalog miss refuses #609 — PR 1: dispatch resolves by identity; a catalog miss refuses (steps 1–4, plus the plan-time mirror decision)
• Products reconcile against claimed entries -- audit and pins #610 — PR 2: products reconcile against claimed entries — audit and pins (steps 5–6)
• file.discover and file.resolve; kind-honest activation #611 — PR 3: file.discover/file.resolve, the runtime grammar, kind-honest activation, the writ audit (the explicit-conversion docket); phase closes

Acceptance: the explicit-conversion scenario suite (13 items) in the plan's judgment-scenarios section — items 1–3 with PRs 1–2, items 4–13 with PR 3.