Embed-path clocks are set independently with no ordering contract, so inner budgets silently invert against outer deadlines

Problem

The embedding path stacks at least six independently-configured clocks: the single-input contention ladder (15s×3), batchEmbeddingTimeoutMs, the KB health probe deadline (300s), the MC write canary deadline (900s-class), the embedding recovery probe cadence, and the tenant-sync sweep cadence. Nothing derives or validates their ordering. Two shipped incident mechanisms are clock inversions: the contention ladder preempting outer probe deadlines (~47s effective vs 300s/900s declared), and the #17049 class (consumer freshness bound below producer cadence). Each was found by manual trace after shipping.

Acceptance Criteria

1. One derivation contract (single module or leaf family, ADR-0019-compliant) that orders every embed-path clock: inner retry ladders < outer probe deadlines < caller ceilings < sweep cadences, each with an explicit margin.
2. Boot-time (or config-load) validation refuses an inverted configuration with a typed diagnostic naming both clocks — never a silent runtime preemption.
3. The contract enumerates its consumer clocks in one table (code-adjacent, greppable) so a new clock cannot be added outside it silently.
4. Spec matrix over the orderings, including the two shipped inversions as regression fixtures.

Evidence class

Source-bound leaf inventory (ai/configBase.mjs) + two independently-traced production inversions (2026-08-14). Generalizes the #17049 finding; complements #17115's template projection.

Part of epic #17072.