request_evolution_restart wrote state/pending_restart_verify.json only when
OUROBOROS_EVOLUTION_AUTO_RESTART was on, so an install that restarts by hand
never reached the exact-claim verify path and absorb attribution fell back to
the markerless boot reconcile. The knob now skips only the restart itself.
- one writer helper (write_pending_restart_marker) and one schema for the
supervisor path and the agent's restart tool; the claim key only for an
exact claim; PERSISTENCE names the single writer
- S22 keeps its markerless-reconcile contract: generation A pins that the
marker IS written with auto-restart off and the tree does not restart, then
shapes the crash-window durable state (two atomic files) after the kill
- ADOPTION row W4-F3 re-prove/done/F6 with the owner quote; DEFERRED_OUT_OF_V70
drops it; ARCHITECTURE names the always-written claim; ledger section
(cherry picked from commit 90ed3720740c1e02e49ae16a52dff8f648784fd2)