Add bounded cross-product proof for action dispatch

[aruintelligence]

What changed

• Enumerate 192 local dispatch vectors across policy, approval, claim, and callback behavior, recording the actual reference boundary receipts and local callback observations.
• Verify the checked-in matrix with a separate project-authored Python state oracle, including digest, callback count and destination, claim consumption, and declared evidence limits.
• Reject four deliberately false reports and run both languages in the action-boundary workflow.
• Document the finite scope and update the rehearsal count to seventeen.

Validation

• node pilots/action-boundary/dispatch-matrix.mjs --check
• python3 pilots/action-boundary/verify_dispatch_matrix.py docs/action-dispatch-matrix.json
• node --test test/action-boundary-dispatch-matrix.test.js test/action-boundary-guarded-tool.test.js test/action-boundary-one-shot.test.js
• npm run check:links
• git diff --check

This is a bounded local project-authored check. It does not authenticate people, contact a provider, establish delivery, explore arbitrary interleavings, or prove production safety. An unknown receipt remains unsafe to retry silently.