Astra round 1 brief: instance key provision (L21), plan rev 1

Review: docs/superpowers/plans/2026-10-10-instance-key-provision.md on branch instance-key-provision, cut from main at 0d338c14.

What it decides. Paul's decision of 2026-10-09: the platform creates each instance's key before the app's first start. The plan has the agent mint CARLOS_INSTANCE_KEY (32 CSPRNG bytes, base64) create-only into <host>.env, the file that already carries CARLOS_ADMIN_TOKEN. The framework contract is rastrillo's carlos.InstanceKey, on rastrillo main e3ea08d. Its order is:

1. the app's own key wins;
2. otherwise $CARLOS_INSTANCE_KEY, verbatim;
3. on CARLOS without a key, the app refuses to start;
4. off CARLOS, nothing changes.

Rollout: the key is written on every box, existing instances included, before any app adopts the helper.

Why it matters. Region HA (docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md, H6 and §5.6) restores a dead box's instance from the replicated database and the files backup. A key minted after start and never backed up leaves sealed data unrecoverable.

Context. The planner's report is in docs/superpowers/plans/INSTANCE-KEY-PLAN-REPORT-R0.md. Its main concern: nothing on main backs up <host>.env yet. Durability before the first start depends on the claim C8 files provider, which moves is building, and that obligation is recorded as O1.

Judge:

1. Create-only. Is it airtight on every path, given the plan's ruling-8 table? The paths: create, backfill, retries, re-render, hibernation restore, move, relocation install and layout move. Can any path overwrite or rotate a key, or leave two processes of one instance holding different keys?
2. Durability before first start. Is the argument sound on legacy boxes and on claim boxes? Is O1 the right obligation, and is it enough?
3. The backfill. Is it safe, idempotent and complete? Is anything missed: hibernated instances, landing paths, nested layouts?
4. Secrecy. Logs, errors, file modes, the console, CLI listings, move reports.
5. Concurrency. Minting under adminTokenMu across seedChild, spawnChildFrom, nested prepareAt and EnsureClaimAdminToken.
6. Tests. Does the code compile against main? Are the tests real, so that each fails without its guard?
7. The planner's five open questions. Replicas, a key set in configuration, report.token, workers and sidecars, and restarts inside a claim session. Say which ones block the build.

Give findings P1/P2/P3 with file:line. End with a verdict: ready to build, or not.