Provision a shared Spawner bridge control key

[vibeforge1111]

Summary

• generate or preserve one strong shared SPARK_BRIDGE_API_KEY for Telegram and Spawner
• fail closed on mismatched, weak, or reused UI, relay, provider, and control secrets
• carry the shared key through hardened generated env writes and profile refreshes
• preserve unchanged legacy Keychain entries without redundant writes
• isolate key resolution and tests so the R-21 line-count ratchet does not grow

Why

The governed Telegram external-research lane reaches Spawner through /api/spark/run, which requires authenticated control-plane access even on loopback. Current setup did not provision a shared bridge key into both processes, so supervised QA failed closed before mission execution. Local staging also showed that unchanged readable Keychain items can have legacy ACLs that reject overwrite; setup now treats an identical stored value idempotently.

Local proof

• python -m pytest -q: 1,466 passed, 2 skipped, 1,158 subtests passed
• R-21: pass; no baselined file grows
• installer metadata: pass
• module provenance: pass
• registry pins: pass, 0 unverified
• release policy binding gate: pass
• gate evidence separation: pass
• pip-audit: no known vulnerabilities
• staged runtime: both generated env files owner-only 0600; keys match and are distinct from provider secrets
• authenticated no-mutation probe: missing key 401, matching key reaches route and returns expected 400 goal is required

Safety and rollback

No public installer pin, points, or production service is changed by this draft. Setup preserves a matching existing key, accepts an explicit coordinated rotation, and stops on unsafe drift. A complete owner-only pre-stage runtime archive was captured before supervised staging. The 13 Dependabot alerts shown by GitHub predate this PR; this branch changes no dependency manifest or lockfile.