Astra round 6 brief: instance key provision, rev 5 (confirming)

Review: docs/superpowers/plans/2026-10-10-instance-key-provision.md rev 5 (caa2609d). It answers your round 5 (CODEX-PLAN-INSTANCE-KEY-R5.md):

• Ruling 27. A configured key is never changed in place: rotation is unsupported, and a coordinated procedure applies to apps with replicas. On every launch of a replica whose key comes from configuration, the agent checks that key against two things: the replica's CARLOS_REPLICA_HOME_KEYS entry, which only the pre-roll check writes, and the key the bucket's configuration holds right now, read fresh at launch. One residual remains: a change made only on the home, such as a hand-edited home <host>.env or a key configured for that host alone. A test documents it.
• Ruling 28. O8 delivers platform-minted keys only. A home whose key exists only in configuration is deferred, and its keyless replica is refused.
• P3. ParseHomeKeys errors report the index and the reason, never the input.

Judge:

1. Are all three findings closed?
2. Is the fresh bucket-config read at a replica launch safe? Consider failure modes, latency, and which outcome a failed read produces.
3. Is the residual acceptable as documented?
4. Anything new?

Give findings P1/P2/P3 with file:line, then a verdict: ready to build, or not.