One streaming ingest pass validates every complete frame, identities,
sequences, lifecycle, joins, conversation facts, and paired trace claims;
inserts bounded ETS rows; and releases each evidence payload before the next
frame is read. After that ingest scan, seal confirmation rehashes evidence
bytes without decoding records so a same-size overwrite cannot publish a
snapshot. A caller that has already proven the artifact identity belongs to
an isolated trace component may return :run_isolated at the trace-facts
boundary; admission then returns the sealed frame indexes for disposal
without materializing trace-dependent projections.