fix(runtime): derive expected repository identity independently of configured root (Closes #973)

canonical_repository_root.py

@@ -221,6 +221,12 @@ def assess_canonical_repository_root(
                 f"remote identity to confirm authorization for '{expected}' "
                 "(fail closed)"
             )
+    elif require_binding:
+        reasons.append(
+            f"canonical repository root '{toplevel}' has configured value "
+            f"'{configured_value}' but authoritative expected repository identity "
+            "is unprovable or missing (fail closed)"
+        )
 
     return _assessment(
         proven=not reasons,