governance: harden resume identity binding and unknown discovery defaults

[davidahmann]

Problem

• Resume flow allowed a caller to pass a different --identity than the job's bound identity.
• Omitted target discovery_method normalized to empty, so policy rules matching discovery_method: [unknown] could miss.
• Digest normalization changes for omitted discovery metadata were not documented for approval-token operators.

Changes

• Preserve bound job identity on resume and reject mismatches with explicit identity binding mismatch error.
• Normalize omitted discovery_method to unknown during intent normalization.
• Add tests for identity mismatch enforcement and unknown discovery matching.
• Update integration/scenario fixtures impacted by deterministic digest change.
• Add upgrade notes to changelog and approval runbook for token reminting after digest normalization change.

Validation

• ./gait doctor --json
• make prepush-full
• go test ./...
• gait gate eval --policy <tmp_policy.yaml> --intent <tmp_intent.json> --json (validated match on discovery_method: [unknown])