World Sim Checkout Arrival

#1130: the World-Sim behind the caller's own checkout ref — the post-purchase page polls this until stage is ready, then focuses that instance. Owner-only: the caller must resolve to a user (acting_user_id — a signed-in human, or a machine token bound to that user; a library token is refused), and only that user's own checkout and instances are ever read. Anyone else's ref is a 404, like the checkout status.