[Astro-Han]

Summary

• make resumed harness runs reuse existing terminal evidence without re-triggering live systemic-stop guards
• score verifier-graded Codex policy-denial attempts from the pinned rollout usage record when normal context usage is unavailable
• preserve ordinary resume only when the current subject and immutable manifest still match
• remove the unsafe unscored-cell backfill path, fixed backfill-jobs namespace, and subject-fingerprint override rather than shipping recovery semantics that can resample or overwrite evidence
• stack on feat(headless): configure harness execution per run #1297 because the resume path reuses its immutable execution-policy contracts

Verification

• focused policy-denial, ordinary resume, and resumed systemic-evidence tests: 134 passed
• headless tests before rebase: 1,173 passed, 1 clean-worktree check skipped
• headless tests after rebasing onto the updated feat(headless): configure harness execution per run #1297: 1,175 passed, 0 failed, 0 skipped
• npm run lint and npm run format:check passed
• source search confirms the removed backfill and subject-override APIs, environment variables, helpers, documentation, and tests have no remaining matches

Review focus

• historical terminal events remain in summaries but do not count as new live events for systemic-stop guards
• policy denial is scored only when Harbor verifier evidence exists
• a changed subject fingerprint still fails closed; this PR provides no same-run backfill or identity bypass
• durable recovery with unique attempt identity and provider-admission evidence is intentionally deferred rather than approximated in this PR