fix(at): use local height for chain-query activation gates

[QuickMythril]

Summary

• record all 22 independently verified ultra-review findings in a durable, dependency-aware remediation plan
• use Core's locally derived execution height for the three AT chain-query activation gates
• add exact-boundary tests proving a hostile claimed height can neither activate an opcode early nor deactivate it once locally active
• refine later tranche ownership without implementing any later recovery, bootstrap, transport, API, Docker, or release changes

Consensus impact

The height carried into AT execution from an incoming block is not part of the signed block bytes. The affected activation checks now use the repository parent height plus one, matching the existing local-height gate used by neighboring AT features.

This applies to:

• GET_TRUST_STATUS_FROM_ACCOUNT_IN_B
• GET_BALANCE_FROM_ACCOUNT_IN_B
• CHECK_CODE_HASH_OF_AT_IN_B

Validation

• regression proof before repair: 2 tests run, 2 expected failures
• focused gate and bytecode integration suites: 29 tests, 0 failures/errors/skips
• serialized full suite with -DskipTests=false: 3,004 tests, 0 failures/errors, 68 skips
• git diff --cached --check: clean
• independent Codex review: no code, consensus-height, lifecycle, or test-design defects found

Scope boundary

This PR completes only T1 / C-01 in docs/development/ultra-review-remediation-plan.md. The remaining findings stay planned or decision-gated and are not represented as fixed here.