Implement all requested actor-session fixes: fail-closed legacy migration provenance, restore GoalSessionExecutor::new source compatibility with a separate validated path, and serialize only tracing-s

[rysweet]

Task Description

Implement all requested actor-session fixes: fail-closed legacy migration provenance, restore GoalSessionExecutor::new source compatibility with a separate validated path, and serialize only tracing-sensitive actor-scope telemetry tests. Preserve existing API/test guarantees. Do not add documentation or commit changes; validate exactly as requested by the user.

Requirements

Final Requirements

1. Legacy session migration must require explicit, persisted, cryptographically or ledger-verifiable provenance tied to the expected actor/session scope. Missing, malformed, mismatched, or untrusted provenance must reject migration without fallback.
2. GoalSessionExecutor::new must retain its existing four-argument infallible signature and behavior so all current callers compile unchanged.
3. Add an explicit fallible validated constructor, conventionally GoalSessionExecutor::try_new_validated, which performs authoritative actor-session validation before returning an executor.
4. Production paths requiring trusted actor-session construction must use the validated constructor. The legacy constructor remains available solely for source compatibility.
5. Preserve unaffected public APIs and behavior. Tighten only legacy migration and explicitly validated construction.
6. Add tests for valid, absent, malformed, untrusted, and scope-mismatched migration provenance, plus constructor source compatibility and validated-construction rejection/acceptance.
7. Apply the repository’s named serial_test lock only to actor-scope telemetry tests that manipulate shared tracing/subscriber state. Functional actor-scope and unrelated tests must remain parallel.
8. Run exactly the targeted validation commands established by the active workflow; all must pass.
9. Do not modify documentation, dependencies, or unrelated code. Do not create commits.
10. Preserve the currently clean working-tree baseline; pre-existing branch history is out of scope.

The requirements are clear and ready for design.

Acceptance Criteria

• All explicit requirements met
• Tests passing
• Philosophy compliant
• Documentation updated

Classification

Generated via default-workflow recipe