fix(sofi): the producer and the verifier read prior attempts the same way

[cryptskii]

The producer and the verifier read prior attempts the same way

No retry in the system could install. Conformance item 5 requires the key an attempt skips past to have a permanent storage resolution. acquire_conformance_evidence handed conformance an empty prior_attempts map unconditionally, so every attempt above zero answered Unavailable(PriorAttempt) and install_fulfillment refused.

This was proved by execution against the merged tree before it was fixed, with a throwaway probe that was deleted afterwards:

PROBE prior_attempts acquired = {}
PROBE conformance at attempt 1 = Unavailable(PriorAttempt { vault_id: 85 42 c4 96 …, attempt: 0 })
PROBE install at attempt 1     = Err(Unavailable(PriorAttempt { vault_id: 85 42 c4 96 …, attempt: 0 }))

The verifier's resolution did read those cells — in its own inline loop, and only the key immediately before. Two paths, two behaviours, one question.

What changes

Per the ruling in §44.4, R9 and R12 now share one acquisition. acquire_prior_attempts(set, P, F, budget) reads, for every leg the fulfillment names at attempt a, the resolution of K^(0) … K^(a-1) of that leg's vault at its parent root. The install calls it; the resolver calls it and its inline loop is deleted.

• A key that could not be read is absent from the map, and conformance answers Unavailable for it. Nothing is assumed skipped.
• An empty map never means there were no prior attempts. It means nothing was read. An attempt of zero has no earlier key and contributes no entry, which is the one case where empty is the truth, and the tests pin that case separately.
• The per-leg bound is the walk's own (sofi_resolve::WALK_BUDGET), for the same reason: past it the earlier keys are unread, so they are Unavailable and the position waits.

Controls

Executed at attempt 1 and attempt 2, as the ruling asks. The second is what proves the acquisition reads the whole run rather than just the key before.

Mutation	Test that goes red
The map is handed over empty (the state before this change)	both of the two below
Only the key immediately before is read	an_attempt_above_zero_installs_once_the_keys_it_skips_are_final
A cell read as open is recorded Final	an_attempt_whose_earlier_key_is_open_waits_and_installs_nothing

The last two were first run together, and reddened both tests — which proves nothing about which mutation the tests are sensitive to. They were re-run singly, and the table records that result. Each restored byte-identical afterwards.

Gates

• SDK (release, --features test-utils): sdk::sofi_* 48/0, two tests new. Core (release): sofi:: 181/0.
• make lint exit 0; ci/production_safety_checks.sh passed; ci/sofi_reachability.py unchanged by this PR.

Spec

§20.2 records the shared acquisition and what an empty map does and does not mean.