fix: bind paper admission receipt to decision digest

[Pigbibi]

Summary

• require the PAPER risk receipt decision digest to exactly match the immutable command decision digest
• document the pre-receipt decision digest boundary to avoid self-reference
• add a fail-closed mismatch regression test

Validation

• PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 uv run --frozen --extra dev pytest -q tests/test_paper_execution_admission.py tests/test_runtime_command_gate.py

No broker, deployment, or live behavior changes.