Each activation leaf was validated and then derived, resolving keychain
secrets and plugin facts twice and folding derivation failures back into
skips. Prepare once and hand the resolved facts to document assembly so
the catalog tree and activation share one judgment set without a dead
fold-back path.
